Protect the emptiness of Array prototype elements with a PropertyCell.

test/mjsunit/elide-double-hole-check-12.js

Index: test/mjsunit/elide-double-hole-check-12.js
diff --git a/test/mjsunit/elide-double-hole-check-11.js b/test/mjsunit/elide-double-hole-check-12.js
similarity index 60%
copy from test/mjsunit/elide-double-hole-check-11.js
copy to test/mjsunit/elide-double-hole-check-12.js
index 4603ac0ac5e03d0704509fe7273d21c08bca016a..758734db89e58fcec8ee3d861e6cd3a816cc1ec3 100644
--- a/test/mjsunit/elide-double-hole-check-11.js
+++ b/test/mjsunit/elide-double-hole-check-12.js
@@ -7,10 +7,17 @@
 function f1(a, i) {
   return a[i] + 0.5;
 }
+
+var other_realm = Realm.create();
 var arr = [,0.0,2.5];
 assertEquals(0.5, f1(arr, 1));
 assertEquals(0.5, f1(arr, 1));
 %OptimizeFunctionOnNextCall(f1);
 assertEquals(0.5, f1(arr, 1));
-Array.prototype.unshift(1.5);
-assertEquals(2, f1(arr, 0));
+
+Realm.shared = arr.__proto__;
+
+// The call syntax is useful to make sure the native context is that of the
+// other realm.
+Realm.eval(other_realm, "Array.prototype.push.call(Realm.shared, 1);");
+assertEquals(1.5, f1(arr, 0));