Revert of [ic] Use validity cells to protect keyed element stores against object's prototype chain…

src/ic/ic.cc

Index: src/ic/ic.cc
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
index feef309d7ab07174bd97a8a4976d15f1840fa309..38fe3314b0630eaf0d8e244c2e190108b6ac65b4 100644
--- a/src/ic/ic.cc
+++ b/src/ic/ic.cc
@@ -603,9 +603,10 @@
   OnTypeFeedbackChanged(isolate(), get_host());
 }
 
+
 void IC::ConfigureVectorState(MapHandleList* maps,
                               MapHandleList* transitioned_maps,
-                              List<Handle<Object>>* handlers) {
+                              CodeHandleList* handlers) {
   DCHECK(UseVector());
   DCHECK(kind() == Code::KEYED_STORE_IC);
   KeyedStoreICNexus* nexus = casted_nexus<KeyedStoreICNexus>();
@@ -2207,7 +2208,7 @@
     Handle<Map> monomorphic_map =
         ComputeTransitionedMap(receiver_map, store_mode);
     store_mode = GetNonTransitioningStoreMode(store_mode);
-    Handle<Object> handler =
+    Handle<Code> handler =
         PropertyICCompiler::ComputeKeyedStoreMonomorphicHandler(monomorphic_map,
                                                                 store_mode);
     return ConfigureVectorState(Handle<Name>(), monomorphic_map, handler);
@@ -2241,7 +2242,7 @@
       // if they at least come from the same origin for a transitioning store,
       // stay MONOMORPHIC and use the map for the most generic ElementsKind.
       store_mode = GetNonTransitioningStoreMode(store_mode);
-      Handle<Object> handler =
+      Handle<Code> handler =
           PropertyICCompiler::ComputeKeyedStoreMonomorphicHandler(
               transitioned_receiver_map, store_mode);
       ConfigureVectorState(Handle<Name>(), transitioned_receiver_map, handler);
@@ -2255,7 +2256,7 @@
       // A "normal" IC that handles stores can switch to a version that can
       // grow at the end of the array, handle OOB accesses or copy COW arrays
       // and still stay MONOMORPHIC.
-      Handle<Object> handler =
+      Handle<Code> handler =
           PropertyICCompiler::ComputeKeyedStoreMonomorphicHandler(receiver_map,
                                                                   store_mode);
       return ConfigureVectorState(Handle<Name>(), receiver_map, handler);
@@ -2316,7 +2317,7 @@
   }
 
   MapHandleList transitioned_maps(target_receiver_maps.length());
-  List<Handle<Object>> handlers(target_receiver_maps.length());
+  CodeHandleList handlers(target_receiver_maps.length());
   PropertyICCompiler::ComputeKeyedStorePolymorphicHandlers(
       &target_receiver_maps, &transitioned_maps, &handlers, store_mode);
   ConfigureVectorState(&target_receiver_maps, &transitioned_maps, &handlers);