Revert "Allow NORMAL ICs to go polymorphic."

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index c3ed767d9f6cd7581beb4537e05c8cc770c7c353..dc15194ec94432419b73f1d8c74bcad458e5c305 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -978,6 +978,12 @@ bool IC::UpdatePolymorphicIC(State state,
                              Handle<String> name,
                              Handle<Code> code,
                              StrictModeFlag strict_mode) {
+  if (code->type() == Code::NORMAL) return false;
+  if (target()->ic_state() == MONOMORPHIC &&
+      target()->type() == Code::NORMAL) {
+    return false;
+  }
+
   MapHandleList receiver_maps;
   CodeHandleList handlers;
 
@@ -986,12 +992,7 @@ bool IC::UpdatePolymorphicIC(State state,
   Handle<Map> new_receiver_map(receiver->map());
   {
     DisallowHeapAllocation no_gc;
-    if (target()->ic_state() == POLYMORPHIC ||
-        (target()->ic_state() == MONOMORPHIC &&
-         target()->type() != Code::NORMAL)) {
-      target()->FindAllMaps(&receiver_maps);
-    }
-
+    target()->FindAllMaps(&receiver_maps);
     int number_of_maps = receiver_maps.length();
     number_of_valid_maps = number_of_maps;
 
@@ -1011,9 +1012,12 @@ bool IC::UpdatePolymorphicIC(State state,
 
     if (number_of_valid_maps >= 4) return false;
 
-    if (number_of_maps > 0) {
-      target()->FindAllCode(&handlers, receiver_maps.length());
+    // Only allow 0 maps in case target() was reset to UNINITIALIZED by the GC.
+    // In that case, allow the IC to go back monomorphic.
+    if (number_of_maps == 0 && target()->ic_state() != UNINITIALIZED) {
+      return false;
     }
+    target()->FindAllCode(&handlers, receiver_maps.length());
   }
 
   number_of_valid_maps++;