Only try to unregister prototype users that are prototypes themselves

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 8d947865d7f70510542e2d5faa40644cdd3277f3..7e3c70aec2fd3d0aa1f9f921b8f210b1103aeac2 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1918,7 +1918,8 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
   // all prototypes further up the chain are also registered with their
   // respective prototypes.
   Object* maybe_old_prototype = old_map->prototype();
-  if (maybe_old_prototype->IsJSObject()) {
+  if (FLAG_track_prototype_users && old_map->is_prototype_map() &&
+      maybe_old_prototype->IsJSObject()) {
     Handle<JSObject> old_prototype(JSObject::cast(maybe_old_prototype));
     bool was_registered =
         JSObject::UnregisterPrototypeUser(old_prototype, old_map);