Protect the emptiness of Array prototype elements with a PropertyCell.

src/heap/heap.cc

Index: src/heap/heap.cc
diff --git a/src/heap/heap.cc b/src/heap/heap.cc
index 50a328a714411a43f110b48f369deb9d11d71d0f..c454da1e905f734b9548456ee80cb3b7706a60b0 100644
--- a/src/heap/heap.cc
+++ b/src/heap/heap.cc
@@ -3105,6 +3105,10 @@ void Heap::CreateInitialObjects() {
   // Handling of script id generation is in Factory::NewScript.
   set_last_script_id(Smi::FromInt(v8::UnboundScript::kNoScriptId));
 
+  Handle<PropertyCell> cell = factory->NewPropertyCell();
+  cell->set_value(Smi::FromInt(1));
+  set_array_protector(*cell);
+
   set_allocation_sites_scratchpad(
       *factory->NewFixedArray(kAllocationSiteScratchpadSize, TENURED));
   InitializeAllocationSitesScratchpad();