Protect the emptiness of Array prototype elements with a PropertyCell.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 95db6d786f6be45e8be742a4c431a09ee3e015e2..1c4996cb5fbd1d324d9e97f9aa8fa760ae6d9c2f 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -5742,9 +5742,6 @@ class DependentCode: public FixedArray {
     // described by this map changes shape (and transitions to a new map),
     // possibly invalidating the assumptions embedded in the code.
     kPrototypeCheckGroup,
-    // Group of code that depends on elements not being added to objects with
-    // this map.
-    kElementsCantBeAddedGroup,
     // Group of code that depends on global property values in property cells
     // not being changed.
     kPropertyCellChangedGroup,
@@ -9829,6 +9826,9 @@ class PropertyCell : public HeapObject {
   static Handle<PropertyCell> InvalidateEntry(Handle<NameDictionary> dictionary,
                                               int entry);
 
+  static void SetValueWithInvalidation(Handle<PropertyCell> cell,
+                                       Handle<Object> new_value);
+
   DECLARE_CAST(PropertyCell)
 
   // Dispatched behavior.