LibJS: Remove transition avoidance & start caching prototype transitions

The way that transition avoidance (foo_without_transition) was
implemented led to shapes being unshareable and caused shape explosion
instead, precisely what we were trying to avoid.

This patch removes all the attempts to avoid transitioning shapes, and
instead *adds* transitions when changing an object's prototype.
This makes transitions flow naturally, and as a result we end up with
way fewer shape objects in real-world situations.

When we run out of big problems, we can get back to avoiding transitions
as an optimization, but for now, let's avoid ballooning our processes
with a unique shape for every object.

Userland/Libraries/LibJS/Runtime/Shape.cpp

@@ -36,6 +36,19 @@ Shape* Shape::get_or_prune_cached_forward_transition(TransitionKey const& key)
     return it->value;
 }
 
+Shape* Shape::get_or_prune_cached_prototype_transition(Object& prototype)
+{
+    auto it = m_prototype_transitions.find(&prototype);
+    if (it == m_prototype_transitions.end())
+        return nullptr;
+    if (!it->value) {
+        // The cached prototype transition has gone stale (from garbage collection). Prune it.
+        m_prototype_transitions.remove(it);
+        return nullptr;
+    }
+    return it->value;
+}
+
 Shape* Shape::create_put_transition(const StringOrSymbol& property_name, PropertyAttributes attributes)
 {
     TransitionKey key { property_name, attributes };
@@ -58,7 +71,11 @@ Shape* Shape::create_configure_transition(const StringOrSymbol& property_name, P
 
 Shape* Shape::create_prototype_transition(Object* new_prototype)
 {
-    return heap().allocate_without_global_object<Shape>(*this, new_prototype);
+    if (auto* existing_shape = get_or_prune_cached_prototype_transition(*new_prototype))
+        return existing_shape;
+    auto* new_shape = heap().allocate_without_global_object<Shape>(*this, new_prototype);
+    m_prototype_transitions.set(new_prototype, new_shape);
+    return new_shape;
 }
 
 Shape::Shape(ShapeWithoutGlobalObjectTag)