Fix

src/stub-cache.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/api.h"
 #include "src/arguments.h"
 #include "src/ast.h"
 #include "src/code-stubs.h"
@@ skipping 951 matching lines @@
 
   // Ensure no transitions to deprecated maps are followed.
   __ CheckMapDeprecated(transition, scratch1(), &miss);
 
   // Check that we are allowed to write this.
   bool is_nonexistent = holder()->map() == transition->GetBackPointer();
   if (is_nonexistent) {
     // Find the top object.
     Handle<JSObject> last;
     PrototypeIterator iter(isolate(), holder());
-    do {
+    while (!iter.IsAtEnd()) {
       last = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
       iter.Advance();
-    } while (!iter.IsAtEnd());
-    set_holder(last);
+    }
+    if (!last.is_null()) set_holder(last);
   }
 
   Register holder_reg = FrontendHeader(receiver(), name, &miss);
 
   // If no property was found, and the holder (the last object in the
   // prototype chain) is in slow mode, we need to do a negative lookup on the
   // holder.
   if (is_nonexistent) {
     GenerateNegativeHolderLookup(masm(), holder(), holder_reg, name, &miss);
   }
@@ skipping 337 matching lines @@
           Handle<FunctionTemplateInfo>(
               FunctionTemplateInfo::cast(signature->receiver()));
     }
   }
 
   is_simple_api_call_ = true;
 }
 
 
 } }  // namespace v8::internal