Revert of [ic] Use validity cells to protect keyed element stores against object's prototype chain…

src/lookup.cc

Index: src/lookup.cc
diff --git a/src/lookup.cc b/src/lookup.cc
index 593e6928f9ae79f9e67c96953e10141f38e9a2c9..186823df8470b2faf0453cc5002c79e9a801f57c 100644
--- a/src/lookup.cc
+++ b/src/lookup.cc
@@ -526,8 +526,11 @@
     Handle<SeededNumberDictionary> dictionary =
         JSObject::NormalizeElements(receiver);
 
-    dictionary = SeededNumberDictionary::Set(dictionary, index_, pair, details,
-                                             receiver);
+    // We unconditionally pass used_as_prototype=false here because the call
+    // to RequireSlowElements takes care of the required IC clearing and
+    // we don't want to walk the heap twice.
+    dictionary =
+        SeededNumberDictionary::Set(dictionary, index_, pair, details, false);
     receiver->RequireSlowElements(*dictionary);
 
     if (receiver->HasSlowArgumentsElements()) {