diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index 133ee1f3f1ba76..dbc6b6af8c038f 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 6
 #define V8_MINOR_VERSION 5
 #define V8_BUILD_NUMBER 254
-#define V8_PATCH_LEVEL 40
+#define V8_PATCH_LEVEL 41
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/src/compiler/escape-analysis.cc b/deps/v8/src/compiler/escape-analysis.cc
index 4b773136a929a3..984c5133968421 100644
--- a/deps/v8/src/compiler/escape-analysis.cc
+++ b/deps/v8/src/compiler/escape-analysis.cc
@@ -623,9 +623,7 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
       break;
     }
     case IrOpcode::kTypeGuard: {
-      // The type-guard is re-introduced in the final reducer if the types
-      // don't match.
-      current->SetReplacement(current->ValueInput(0));
+      current->SetVirtualObject(current->ValueInput(0));
       break;
     }
     case IrOpcode::kReferenceEqual: {
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-18.js b/deps/v8/test/mjsunit/compiler/escape-analysis-18.js
new file mode 100644
index 00000000000000..f2ff08299fe9d8
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-18.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function bar(arr) {
+    var x = 0;
+    arr.forEach(function(el) {
+        x = el;
+    });
+    return x;
+}
+
+function foo(array) {
+    return bar(array);
+}
+
+let array = [,.5,];
+foo(array);
+foo(array);
+%OptimizeFunctionOnNextCall(foo);
+foo(array);