[ic] Invalidate prototype validity cell when a slow prototype becomes fast.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 0bc2a84896ae868f494e70769a76b8b2c5f213b5..36df2599ca232ed3c9b62f669d9517cf40cf1cbc 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2353,6 +2353,11 @@ class JSObject: public JSReceiver {
   static bool UnregisterPrototypeUser(Handle<Map> user, Isolate* isolate);
   static void InvalidatePrototypeChains(Map* map);
 
+  // Updates prototype chain tracking information when an object changes its
+  // map from |old_map| to |new_map|.
+  static void NotifyMapChange(Handle<Map> old_map, Handle<Map> new_map,
+                              Isolate* isolate);
+
   // Utility used by many Array builtins and runtime functions
   static inline bool PrototypeHasNoElements(Isolate* isolate, JSObject* object);