Use Cells to check prototype chain validity (disabled by default).

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index f9ed74a480a42e74ab7b789d5e34aaa6c98b6845..f36cd1f083f610a8e646ae22d94d0a4057d98ecd 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1832,6 +1832,7 @@ class JSObject: public JSReceiver {
                                     Handle<HeapObject> user);
   static void UnregisterPrototypeUser(Handle<JSObject> prototype,
                                       Handle<HeapObject> user);
+  static void InvalidatePrototypeChains(Map* map);
 
   // Retrieve interceptors.
   InterceptorInfo* GetNamedInterceptor();
@@ -6028,6 +6029,15 @@ class Map: public HeapObject {
   // (which prototype maps don't have).
   DECL_ACCESSORS(prototype_info, Object)
 
+  // [prototype chain validity cell]: Associated with a prototype object,
+  // stored in that object's map's PrototypeInfo, indicates that prototype
+  // chains through this object are currently valid. The cell will be
+  // invalidated and replaced when the prototype chain changes.
+  static Handle<Cell> GetOrCreatePrototypeChainValidityCell(Handle<Map> map,
+                                                            Isolate* isolate);
+  static const int kPrototypeChainValid = 0;
+  static const int kPrototypeChainInvalid = 1;
+
   Map* FindRootMap();
   Map* FindFieldOwner(int descriptor);