Fix stale IC::receiver_map_ after prototype fastification

BUG=chromium:618845

Review-Url: https://codereview.chromium.org/2058063002
Cr-Commit-Position: refs/heads/master@{#36891}

src/ic/ic.cc

@@ -651,6 +651,7 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
 
   if (state() != UNINITIALIZED) {
     JSObject::MakePrototypesFast(object, kStartAtReceiver, isolate());
+    update_receiver_map(object);
   }
   // Named lookup in the object.
   LookupIterator it(object, name);

test/mjsunit/regress/regress-crbug-618845.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Foo() {}
+Object.defineProperty(Foo.prototype, "name",
+                      {get: function() { return "FooName"; }});
+
+function ic(f) {
+  return f.prototype.name;
+}
+
+assertEquals("FooName", ic(Foo));
+assertEquals("FooName", ic(Foo));  // Don't crash, don't time out.