Only update POLYMORPHIC stubs using other POLYMORPHIC or GENERIC stubs.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index 9d5bf17b936a44b966ac658fa5e12310f26d12d7..c452791e7525ef682ef28ed78f18f80e16ca7b60 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -753,7 +753,7 @@ void CallICBase::UpdateCaches(LookupResult* lookup,
       if (code->ic_state() != MONOMORPHIC) {
         Map* map = target()->FindFirstMap();
         if (map != NULL) {
-          isolate()->stub_cache()->Set(*name, map, target());
+          UpdateMegamorphicCache(map, *name, target());
         }
       }
       set_target(*code);
@@ -765,7 +765,7 @@ void CallICBase::UpdateCaches(LookupResult* lookup,
           ? Handle<JSObject>::cast(object)
           : Handle<JSObject>(JSObject::cast(object->GetPrototype()));
       // Update the stub cache.
-      isolate()->stub_cache()->Set(*name, cache_object->map(), *code);
+      UpdateMegamorphicCache(cache_object->map(), *name, *code);
       break;
     }
     case DEBUG_STUB:
@@ -972,7 +972,6 @@ void IC::PatchCache(State state,
     case UNINITIALIZED:
     case PREMONOMORPHIC:
     case MONOMORPHIC_PROTOTYPE_FAILURE:
-    case POLYMORPHIC:
       set_target(*code);
       break;
     case MONOMORPHIC:
@@ -995,6 +994,16 @@ void IC::PatchCache(State state,
       // Update the stub cache.
       UpdateMegamorphicCache(receiver->map(), *name, *code);
       break;
+    case POLYMORPHIC:
+      // When trying to patch a polymorphic stub with anything other than
+      // another polymorphic stub, go generic.
+      // TODO(verwaest): Currently we always go generic since no polymorphic
+      // stubs enter this code path. Replace with proper updating once named
+      // load/store can also be polymorphic.
+      set_target((strict_mode == kStrictMode)
+                 ? *generic_stub_strict()
+                 : *generic_stub());
+      break;
     case GENERIC:
     case DEBUG_STUB:
       break;