[IC] Ensure we don't transition receivers when there's a data property in the...

[IC] Ensure we don't transition receivers when there's a data property in the hidden prototype chain.

BUG=chromium:542647
R=cbruni@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1406873002

Cr-Commit-Position: refs/heads/master@{#31357}

src/ic/ic.cc

@@ -1489,6 +1489,8 @@ bool StoreIC::LookupForWrite(LookupIterator* it, Handle<Object> value,
               PrototypeIterator::GetCurrent(iter));
         }
 
+        if (it->HolderIsReceiverOrHiddenPrototype()) return false;
+
         it->PrepareTransitionToDataProperty(value, NONE, store_mode);
         return it->IsCacheableTransition();
       }