[ic] Use validity cells to protect keyed element stores against object's prototype chain modificati…

src/lookup.cc

Index: src/lookup.cc
diff --git a/src/lookup.cc b/src/lookup.cc
index 186823df8470b2faf0453cc5002c79e9a801f57c..593e6928f9ae79f9e67c96953e10141f38e9a2c9 100644
--- a/src/lookup.cc
+++ b/src/lookup.cc
@@ -526,11 +526,8 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
     Handle<SeededNumberDictionary> dictionary =
         JSObject::NormalizeElements(receiver);
 
-    // We unconditionally pass used_as_prototype=false here because the call
-    // to RequireSlowElements takes care of the required IC clearing and
-    // we don't want to walk the heap twice.
-    dictionary =
-        SeededNumberDictionary::Set(dictionary, index_, pair, details, false);
+    dictionary = SeededNumberDictionary::Set(dictionary, index_, pair, details,
+                                             receiver);
     receiver->RequireSlowElements(*dictionary);
 
     if (receiver->HasSlowArgumentsElements()) {