Optimize @@species based on a global 'protector' cell

src/isolate.h

Index: src/isolate.h
diff --git a/src/isolate.h b/src/isolate.h
index b263d5b0f700a0d3dbff1c9955a3e14486a7f3b1..2d74dc4a63a9b89d4542eb1ec8a8ab24662ddd4d 100644
--- a/src/isolate.h
+++ b/src/isolate.h
@@ -960,6 +960,7 @@ class Isolate {
   static const int kArrayProtectorInvalid = 0;
 
   bool IsFastArrayConstructorPrototypeChainIntact();
+  bool IsArraySpeciesLookupChainIntact();
 
   // On intent to set an element in object, make sure that appropriate
   // notifications occur if the set is on the elements of the array or
@@ -975,6 +976,7 @@ class Isolate {
   void UpdateArrayProtectorOnNormalizeElements(Handle<JSObject> object) {
     UpdateArrayProtectorOnSetElement(object);
   }
+  void InvalidateArraySpeciesProtector();
 
   // Returns true if array is the initial array prototype in any native context.
   bool IsAnyInitialArrayPrototype(Handle<JSArray> array);