[ic] Use validity cells to protect keyed element stores against object's prototype chain modificati…

src/type-feedback-vector.h

Index: src/type-feedback-vector.h
diff --git a/src/type-feedback-vector.h b/src/type-feedback-vector.h
index 069c8318587efcff6653ccb3bd091ab11a10e430..4b62ee86b6eafb69029e1cfbc7f300938f2b6f47 100644
--- a/src/type-feedback-vector.h
+++ b/src/type-feedback-vector.h
@@ -264,9 +264,6 @@ class TypeFeedbackVector : public FixedArray {
     ClearSlotsImpl(shared, false);
   }
 
-  static void ClearAllKeyedStoreICs(Isolate* isolate);
-  void ClearKeyedStoreICs(SharedFunctionInfo* shared);
-
   // The object that indicates an uninitialized cache.
   static inline Handle<Symbol> UninitializedSentinel(Isolate* isolate);
 
@@ -606,7 +603,7 @@ class KeyedStoreICNexus : public FeedbackNexus {
                             List<Handle<Object>>* handlers);
   void ConfigurePolymorphic(MapHandleList* maps,
                             MapHandleList* transitioned_maps,
-                            CodeHandleList* handlers);
+                            List<Handle<Object>>* handlers);
   void ConfigureMegamorphicKeyed(IcCheckType property_type);
 
   KeyedAccessStoreMode GetKeyedAccessStoreMode() const;