Use Cells to check prototype chain validity (disabled by default).

src/flag-definitions.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file defines all of the flags.  It is separated into different section,
 // for Debug, Release, Logging and Profiling, etc.  To add a new flag, find the
 // correct section, and use one of the DEFINE_ macros, without a trailing ';'.
 //
 // This include does not have a guard, because it is a template-style include,
 // which can be included multiple times in different modes.  It expects to have
@@ skipping 657 matching lines @@
 DEFINE_BOOL(zap_code_space, true,
             "Zap free memory in code space with 0xCC while sweeping.")
 DEFINE_INT(random_seed, 0,
            "Default seed for initializing random generator "
            "(0, the default, means to use system random).")
 
 // objects.cc
 DEFINE_BOOL(trace_weak_arrays, false, "trace WeakFixedArray usage")
 DEFINE_BOOL(track_prototype_users, false,
             "keep track of which maps refer to a given prototype object")
+DEFINE_BOOL(eliminate_prototype_chain_checks, false,
+            "collapse prototype chain checks into single-cell checks")
+DEFINE_IMPLICATION(eliminate_prototype_chain_checks, track_prototype_users)
 DEFINE_BOOL(use_verbose_printer, true, "allows verbose printing")
 #if TRACE_MAPS
 DEFINE_BOOL(trace_maps, false, "trace map creation")
 #endif
 
 // parser.cc
 DEFINE_BOOL(allow_natives_syntax, false, "allow natives syntax")
 DEFINE_BOOL(trace_parse, false, "trace parsing and preparsing")
 
 // simulator-arm.cc, simulator-arm64.cc and simulator-mips.cc
@@ skipping 354 matching lines @@
 #undef DEFINE_ALIAS_FLOAT
 #undef DEFINE_ALIAS_ARGS
 
 #undef FLAG_MODE_DECLARE
 #undef FLAG_MODE_DEFINE
 #undef FLAG_MODE_DEFINE_DEFAULTS
 #undef FLAG_MODE_META
 #undef FLAG_MODE_DEFINE_IMPLICATIONS
 
 #undef COMMA