Protect the emptiness of Array prototype elements with a PropertyCell.

src/isolate.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_ISOLATE_H_
 #define V8_ISOLATE_H_
 
 #include <queue>
 #include "include/v8-debug.h"
 #include "src/allocation.h"
@@ skipping 998 matching lines @@
     if (date_cache != date_cache_) {
       delete date_cache_;
     }
     date_cache_ = date_cache;
   }
 
   Map* get_initial_js_array_map(ElementsKind kind);
 
   bool IsFastArrayConstructorPrototypeChainIntact();
 
+  // On intent to set an element in object, make sure that appropriate
+  // notifications occur if the set is on the elements of the array or
+  // object prototype. Also ensure that changes to prototype chain between
+  // Array and Object fire notifications.
+  void UpdateArrayProtectorOnSetElement(Handle<JSObject> object);
+  void UpdateArrayProtectorOnSetPrototype(Handle<JSObject> object) {
+    UpdateArrayProtectorOnSetElement(object);
+  }
+  void UpdateArrayProtectorOnNormalizeElements(Handle<JSObject> object) {
+    UpdateArrayProtectorOnSetElement(object);
+  }
+
+  // Returns true if array is the initial array prototype in any native context.
+  bool IsAnyInitialArrayPrototype(Handle<JSArray> array);
+
   CallInterfaceDescriptorData* call_descriptor_data(int index);
 
   void IterateDeferredHandles(ObjectVisitor* visitor);
   void LinkDeferredHandles(DeferredHandles* deferred_handles);
   void UnlinkDeferredHandles(DeferredHandles* deferred_handles);
 
 #ifdef DEBUG
   bool IsDeferredHandle(Object** location);
 #endif  // DEBUG
 
@@ skipping 540 matching lines @@
   }
 
   EmbeddedVector<char, 128> filename_;
   FILE* file_;
   int scope_depth_;
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_ISOLATE_H_