Only try to unregister prototype users that are prototypes themselves

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <iomanip>
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 1900 matching lines @@
   // prototype chains involving it.
   InvalidatePrototypeChains(object->map());
   Handle<Map> old_map(object->map());
 
   // If the map was registered with its prototype before, ensure that it
   // registers with its new prototype now. This preserves the invariant that
   // when a map on a prototype chain is registered with its prototype, then
   // all prototypes further up the chain are also registered with their
   // respective prototypes.
   Object* maybe_old_prototype = old_map->prototype();
-  if (maybe_old_prototype->IsJSObject()) {
+  if (FLAG_track_prototype_users && old_map->is_prototype_map() &&
+      maybe_old_prototype->IsJSObject()) {
     Handle<JSObject> old_prototype(JSObject::cast(maybe_old_prototype));
     bool was_registered =
         JSObject::UnregisterPrototypeUser(old_prototype, old_map);
     if (was_registered) {
       JSObject::LazyRegisterPrototypeUser(new_map, new_map->GetIsolate());
     }
   }
 
   if (object->HasFastProperties()) {
     if (!new_map->is_dictionary_map()) {
@@ skipping 15269 matching lines @@
 void PropertyCell::SetValueWithInvalidation(Handle<PropertyCell> cell,
                                             Handle<Object> new_value) {
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 } }  // namespace v8::internal