Optimize @@species based on a global 'protector' cell

test/mjsunit/harmony/array-species.js

Index: test/mjsunit/harmony/array-species.js
diff --git a/test/mjsunit/harmony/array-species.js b/test/mjsunit/harmony/array-species.js
index 1662a120e25bddbe077d39e89358e3fe2104c789..3cef50cc4c9eb3e5778f33d7e7aa4871d85c315a 100644
--- a/test/mjsunit/harmony/array-species.js
+++ b/test/mjsunit/harmony/array-species.js
@@ -153,16 +153,14 @@ count = 0;
 params = undefined;
 assertEquals(MyObservedArray,
              new MyObservedArray().slice().constructor);
-// TODO(littledan): Should be 1
-assertEquals(2, count);
+assertEquals(1, count);
 assertArrayEquals([0], params);
 
 count = 0;
 params = undefined;
 assertEquals(MyObservedArray,
              new MyObservedArray().splice().constructor);
-// TODO(littledan): Should be 1
-assertEquals(2, count);
+assertEquals(1, count);
 assertArrayEquals([0], params);
 
 // @@species constructor can be a Proxy, and the realm access doesn't