Protect the emptiness of Array prototype elements with a PropertyCell.

src/compilation-dependencies.h

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_DEPENDENCIES_H_
 #define V8_DEPENDENCIES_H_
 
 namespace v8 {
 namespace internal {
 
 // Collects dependencies for this compilation, e.g. assumptions about
 // stable maps, constant globals, etc.
 class CompilationDependencies {
  public:
   CompilationDependencies(Isolate* isolate, Zone* zone)
       : isolate_(isolate),
         zone_(zone),
         object_wrapper_(Handle<Foreign>::null()),
         aborted_(false) {
     std::fill_n(groups_, DependentCode::kGroupCount, nullptr);
   }
 
   void Insert(DependentCode::DependencyGroup group, Handle<HeapObject> handle);
 
   void AssumeInitialMapCantChange(Handle<Map> map) {
     Insert(DependentCode::kInitialMapChangedGroup, map);
   }
-  void AssumeElementsCantBeAdded(Handle<Map> map) {
-    Insert(DependentCode::kElementsCantBeAddedGroup, map);
-  }
   void AssumeFieldType(Handle<Map> map) {
     Insert(DependentCode::kFieldTypeGroup, map);
   }
   void AssumePropertyCell(Handle<PropertyCell> cell) {
     Insert(DependentCode::kPropertyCellChangedGroup, cell);
   }
   void AssumeTenuringDecision(Handle<AllocationSite> site) {
     Insert(DependentCode::kAllocationSiteTenuringChangedGroup, site);
   }
   void AssumeTransitionStable(Handle<AllocationSite> site);
@@ skipping 17 matching lines @@
   bool aborted_;
   ZoneList<Handle<HeapObject> >* groups_[DependentCode::kGroupCount];
 
   DependentCode* Get(Handle<Object> object);
   void Set(Handle<Object> object, Handle<DependentCode> dep);
 };
 }
 }  // namespace v8::internal
 
 #endif  // V8_DEPENDENCIES_H_