Only to the relevant checks in LoadFunctionPrototype

src/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/arguments.h"
 #include "src/codegen.h"
@@ skipping 919 matching lines @@
       return string_length_stub.GetCode();
     } else {
       KeyedStringLengthStub string_length_stub(isolate());
       return string_length_stub.GetCode();
     }
   }
 
   // Use specialized code for getting prototype of functions.
   if (object->IsJSFunction() &&
       String::Equals(isolate()->factory()->prototype_string(), name) &&
-      Handle<JSFunction>::cast(object)->should_have_prototype()) {
+      Handle<JSFunction>::cast(object)->should_have_prototype() &&
+      !Handle<JSFunction>::cast(object)->map()->has_non_instance_prototype()) {
     Handle<Code> stub;
     FunctionPrototypeStub function_prototype_stub(isolate(), kind());
     return function_prototype_stub.GetCode();
   }
 
   Handle<HeapType> type = receiver_type();
   Handle<JSObject> holder(lookup->holder());
   bool receiver_is_holder = object.is_identical_to(holder);
   LoadStubCompiler compiler(isolate(), kNoExtraICState, cache_holder, kind());
 
@@ skipping 2089 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal