Optimize @@species based on a global 'protector' cell

test/mjsunit/harmony/array-species.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-species --harmony-proxies
 
 // Test the ES2015 @@species feature
 
 'use strict';
 
@@ skipping 135 matching lines @@
 params = undefined;
 assertEquals(MyObservedArray,
              new MyObservedArray().concat().constructor);
 assertEquals(1, count);
 assertArrayEquals([0], params);
 
 count = 0;
 params = undefined;
 assertEquals(MyObservedArray,
              new MyObservedArray().slice().constructor);
-// TODO(littledan): Should be 1
-assertEquals(2, count);
+assertEquals(1, count);
 assertArrayEquals([0], params);
 
 count = 0;
 params = undefined;
 assertEquals(MyObservedArray,
              new MyObservedArray().splice().constructor);
-// TODO(littledan): Should be 1
-assertEquals(2, count);
+assertEquals(1, count);
 assertArrayEquals([0], params);
 
 // @@species constructor can be a Proxy, and the realm access doesn't
 // crash
 
 class MyProxyArray extends Array { }
 let ProxyArray = new Proxy(MyProxyArray, {});
 MyProxyArray.constructor = ProxyArray;
 
 assertEquals(MyProxyArray, new ProxyArray().map(()=>{}).constructor);