Optimize @@species based on a global 'protector' cell

src/isolate.h

Index: src/isolate.h
diff --git a/src/isolate.h b/src/isolate.h
index b66057587f6d3250284986fda295154084db8e68..1fa1a01d70e8147f5f921b7143b26566f2557b38 100644
--- a/src/isolate.h
+++ b/src/isolate.h
@@ -960,6 +960,7 @@ class Isolate {
   static const int kArrayProtectorInvalid = 0;
 
   bool IsFastArrayConstructorPrototypeChainIntact();
+  bool IsArraySpeciesLookupChainIntact();
 
   // On intent to set an element in object, make sure that appropriate
   // notifications occur if the set is on the elements of the array or
@@ -975,6 +976,7 @@ class Isolate {
   void UpdateArrayProtectorOnNormalizeElements(Handle<JSObject> object) {
     UpdateArrayProtectorOnSetElement(object);
   }
+  void InvalidateArraySpeciesProtector();
 
   // Returns true if array is the initial array prototype in any native context.
   bool IsAnyInitialArrayPrototype(Handle<JSArray> array);