Overwrite the handler using Set.

src/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1004 matching lines @@
     // Only allow 0 maps in case target() was reset to UNINITIALIZED by the GC.
     // In that case, allow the IC to go back monomorphic.
     if (number_of_maps == 0 && target()->ic_state() != UNINITIALIZED) {
       return false;
     }
     target()->FindAllCode(&handlers, receiver_maps.length());
   }
 
   number_of_valid_maps++;
   if (handler_to_overwrite >= 0) {
-    handlers.InsertAt(handler_to_overwrite, code);
+    handlers.Set(handler_to_overwrite, code);
   } else {
     receiver_maps.Add(new_receiver_map);
     handlers.Add(code);
   }
 
   Handle<Code> ic = isolate()->stub_cache()->ComputePolymorphicIC(
       &receiver_maps, &handlers, number_of_valid_maps, name);
   set_target(*ic);
   return true;
 }
@@ skipping 1938 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal