[turbofan] Properly handle dictionary maps in the prototype chain.

src/compiler/js-native-context-specialization.h

Index: src/compiler/js-native-context-specialization.h
diff --git a/src/compiler/js-native-context-specialization.h b/src/compiler/js-native-context-specialization.h
index 7d43bfb26d7c068a5970198064cdd798bebbc38b..0c7d4fc086165b77f1b4a315f3575de3e90cef78 100644
--- a/src/compiler/js-native-context-specialization.h
+++ b/src/compiler/js-native-context-specialization.h
@@ -80,10 +80,12 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   Reduction ReduceSoftDeoptimize(Node* node);
 
   // Adds stability dependencies on all prototypes of every class in
-  // {receiver_type} up to (and including) the {holder}.
-  void AssumePrototypesStable(Type* receiver_type,
-                              Handle<Context> native_context,
-                              Handle<JSObject> holder);
+  // {receiver_type} up to (and including) the {holder} if the maps
+  // are stable, otherwise falls back to inserting runtime map checks
+  // on the prototypes.
+  Node* CheckPrototypeMaps(Type* receiver_type, Handle<Context> native_context,
+                           Handle<JSObject> holder, Node* effect,
+                           Node* control);
 
   // Extract receiver maps from {nexus} and filter based on {receiver} if
   // possible.