Use Cells to check prototype chain validity (disabled by default).

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 10a9ed28416a8cc5edbc432ec8d5b2fcea3ea85d..1fd325fc4a3163bfc0a6f8770417d737e88655f2 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1831,6 +1831,7 @@ class JSObject: public JSReceiver {
                                     Handle<HeapObject> user);
   static void UnregisterPrototypeUser(Handle<JSObject> prototype,
                                       Handle<HeapObject> user);
+  static void InvalidatePrototypeChains(Map* map);
 
   // Retrieve interceptors.
   InterceptorInfo* GetNamedInterceptor();
@@ -5985,6 +5986,15 @@ class Map: public HeapObject {
   // (which prototype maps don't have).
   DECL_ACCESSORS(prototype_info, Object)
 
+  // [prototype chain validity cell]: Associated with a prototype object,
+  // stored in that object's map's PrototypeInfo, indicates that prototype
+  // chains through this object are currently valid. The cell will be
+  // invalidated and replaced when the prototype chain changes.
+  static Handle<Cell> GetOrCreatePrototypeChainValidityCell(Handle<Map> map,
+                                                            Isolate* isolate);
+  static const int kPrototypeChainValid = 0;
+  static const int kPrototypeChainInvalid = 1;
+
   Map* FindRootMap();
   Map* FindFieldOwner(int descriptor);