LibJS/Bytecode: Invalidate inline caches on unique shape mutation

Since we can't rely on shape identity (i.e its pointer address) for
unique shapes, give them a serial number that increments whenever a
mutation occurs.

Inline caches can then compare this serial number against what they
have seen before.

Userland/Libraries/LibJS/Tests/inline-cache-edge-cases.js

@@ -0,0 +1,18 @@
+test("Inline cache invalidated by deleting property from unique shape", () => {
+    // Create an object with an unique shape by adding a huge amount of properties.
+    let o = {};
+    for (let x = 0; x < 1000; ++x) {
+        o["prop" + x] = x;
+    }
+
+    function ic(o) {
+        return o.prop2;
+    }
+
+    let first = ic(o);
+    delete o.prop2;
+    let second = ic(o);
+
+    expect(first).toBe(2);
+    expect(second).toBeUndefined();
+});