Merged r11861 into 3.11 branch.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 61488aff2aa935a69998e01c16804c355d719779..2c8a0f659c3a688fb1670c6164261c07c1d765d2 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -4698,7 +4698,7 @@ HInstruction* HGraphBuilder::BuildStoreNamedField(HValue* object,
   // If the property does not exist yet, we have to check that it wasn't made
   // readonly or turned into a setter by some meanwhile modifications on the
   // prototype chain.
-  if (!lookup->IsProperty()) {
+  if (!lookup->IsProperty() && type->prototype()->IsJSReceiver()) {
     Object* proto = type->prototype();
     // First check that the prototype chain isn't affected already.
     LookupResult proto_result(isolate());