Make array __proto__ manipulations not disturb the species protector

test/mjsunit/harmony/array-species-constructor.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species
+// Flags: --harmony-species --allow-natives-syntax
 
 // Overwriting the constructor of an instance updates the protector
 
 let x = [];
 
 assertEquals(Array, x.map(()=>{}).constructor);
 assertEquals(Array, x.filter(()=>{}).constructor);
 assertEquals(Array, x.slice().constructor);
 assertEquals(Array, x.splice().constructor);
 assertEquals(Array, x.concat([1]).constructor);
 assertEquals(1, x.concat([1])[0]);
 
 class MyArray extends Array { }
 
 x.constructor = MyArray;
+assertFalse(%SpeciesProtector());

[Camillo Bruni, 2016/05/11 12:50:08]

nit: could you also check that the SpeciesProtector is valid before you change
the constructor?

[Dan Ehrenberg, 2016/05/11 14:32:16]

No because apparently 'stress' runs happen multiple times in the same isolate
and that fails.

 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);
 assertEquals(MyArray, x.slice().constructor);
 assertEquals(MyArray, x.splice().constructor);
 assertEquals(MyArray, x.concat([1]).constructor);
 assertEquals(1, x.concat([1])[0]);