Protect the emptiness of Array prototype elements with a PropertyCell.

src/isolate.h

Index: src/isolate.h
diff --git a/src/isolate.h b/src/isolate.h
index a434edd440c68c4b9d48d93c07a2a16aa9ec344d..d8850bcff478a964f3487e9fd245d7e314becd67 100644
--- a/src/isolate.h
+++ b/src/isolate.h
@@ -1016,6 +1016,21 @@ class Isolate {
 
   bool IsFastArrayConstructorPrototypeChainIntact();
 
+  // On intent to set an element in object, make sure that appropriate
+  // notifications occur if the set is on the elements of the array or
+  // object prototype. Also ensure that changes to prototype chain between
+  // Array and Object fire notifications.
+  void MaintainArrayProtectorOnSetElement(Handle<JSObject> object);

[Jakob Kummerow, 2015/04/21 15:41:49]

naming nit: "Maintain" doesn't sound like something is about to change. How
about "Update" or "Invalidate"?

[mvstanton, 2015/04/22 07:22:33]

Good idea, I'll go with Update.

+  void MaintainArrayProtectorOnSetPrototype(Handle<JSObject> object) {
+    MaintainArrayProtectorOnSetElement(object);
+  }
+  void MaintainArrayProtectorOnNormalizeElements(Handle<JSObject> object) {
+    MaintainArrayProtectorOnSetElement(object);
+  }
+
+  // Returns true if array is the initial array prototype in any native context.
+  bool IsAnyInitialArrayPrototype(Handle<JSArray> array);
+
   CallInterfaceDescriptorData* call_descriptor_data(int index);
 
   void IterateDeferredHandles(ObjectVisitor* visitor);