[ic] Use validity cells to protect keyed element stores against object's prototype chain modificati…

test/mjsunit/regress/regress-crbug-669411.js

Index: test/mjsunit/regress/regress-crbug-669411.js
diff --git a/test/mjsunit/regress/regress-crbug-669411.js b/test/mjsunit/regress/regress-crbug-669411.js
new file mode 100644
index 0000000000000000000000000000000000000000..469934f8ffb98cab8224a4f15ff212d87ccb6620
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-669411.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(o) {
+  o[5000000] = 0;
+}
+var o = Object.create(null);
+f(o);
+f(o);
+f(o);