[ic] Invalidate prototype validity cell when a slow prototype becomes fast.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index a9036992f4afa4a8211bed5edbc1b9dc25e5dff4..c791c62fe7fb55188468dac96d6bff9d77aadf1c 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2353,6 +2353,11 @@ class JSObject: public JSReceiver {
   static bool UnregisterPrototypeUser(Handle<Map> user, Isolate* isolate);
   static void InvalidatePrototypeChains(Map* map);
 
+  // Updates prototype chain tracking information when an object changes its
+  // map from |old_map| to |new_map|.
+  static void NotifyMapChange(Handle<Map> old_map, Handle<Map> new_map,
+                              Isolate* isolate);
+
   // Utility used by many Array builtins and runtime functions
   static inline bool PrototypeHasNoElements(Isolate* isolate, JSObject* object);