Lookup transition again after migrating a transition target.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index ef8ab8a309eb3a4e5bb067f3cf2419b3629f05c4..db1cb956edc75f64fdf6249ef0c25fe1e8f20bdc 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1541,6 +1541,10 @@ static bool LookupForWrite(Handle<JSObject> receiver,
     Handle<Map> target(lookup->GetTransitionMapFromMap(receiver->map()));
     Map::GeneralizeRepresentation(
         target, target->LastAdded(), value->OptimalRepresentation());
+    // Lookup the transition again since the transition tree may have changed
+    // entirely by the migration above.
+    receiver->map()->LookupTransition(*holder, *name, lookup);
+    if (!lookup->IsTransition()) return false;
     *state = MONOMORPHIC_PROTOTYPE_FAILURE;
   }
   return true;