Implement immutable prototype chains

test/mjsunit/regress/regress-crbug-571517.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 function Receiver() { this.receiver = "receiver"; }
 function Proto() { this.proto = "proto"; }
 
 function f(a) {
   return a.foo;
 }
 
 var rec = new Receiver();
 
-var proto = rec.__proto__.__proto__;
+// Formerly, this mutated rec.__proto__.__proto__, but
+// the global object prototype chain is now immutable;
+// not sure if this test now hits the original hazard case.
+var proto = rec.__proto__;
 
 // Initialize prototype chain dependent IC (nonexistent load).
 assertEquals(undefined, f(rec));
 assertEquals(undefined, f(rec));
 
 // Add a new prototype to the end of the chain.
 var p2 = new Proto();
 p2.__proto__ = null;
 proto.__proto__ = p2;
 
 // Update the IC.
 assertEquals(undefined, f(rec));
 
 // Now modify the most recently added prototype by adding a property...
 p2.foo = "bar";
 assertEquals("bar", f(rec));
 
 // ...and removing it again. Due to missing prototype user registrations,
 // this fails to invalidate the IC.
 delete p2.foo;
 p2.secret = "GAME OVER";
 assertEquals(undefined, f(rec));