[ic] Invalidate prototype validity cell when a slow prototype becomes fast.

test/mjsunit/regress/regress-crbug-665886.js

Index: test/mjsunit/regress/regress-crbug-665886.js
diff --git a/test/mjsunit/regress/regress-crbug-665886.js b/test/mjsunit/regress/regress-crbug-665886.js
new file mode 100644
index 0000000000000000000000000000000000000000..b3309c249f7c6be299b53c0042d2db756fad3261
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-665886.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[1].toLocaleString();
+delete Number.prototype.toLocaleString;
+[1].toLocaleString();
+var o = {};
+o.__proto__ = { toString: Array.prototype.toString };
+o.toString();
+Number.prototype.arrayToString = Array.prototype.toString;
+(42).arrayToString();
+var a = [7];
+a.toLocaleString();