Make array __proto__ manipulations not disturb the species protector

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 4bdfe5e1a6de3db64c5d9de5519e0899f6544e8b..8d375bb388602a31d0dd6e0504a833883a5a8246 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -698,7 +698,7 @@ BUILTIN(ArraySlice) {
         !IsJSArrayFastElementMovingAllowed(isolate, array) ||
         !isolate->IsArraySpeciesLookupChainIntact() ||
         // If this is a subclass of Array, then call out to JS
-        !array->map()->new_target_is_base()) {
+        !array->HasArrayPrototype(isolate)) {

[adamk, 2016/05/03 00:45:31]

Given your claim in the CL description about the safety of comparing the
prototype, it seems like it might make more sense to inline HasArrayPrototype
here and below.

[Dan Ehrenberg, 2016/05/04 00:18:50]

I improved the comment above HasArrayPrototype

       AllowHeapAllocation allow_allocation;
       return CallJsIntrinsic(isolate, isolate->array_slice(), args);
     }
@@ -759,7 +759,8 @@ BUILTIN(ArraySplice) {
   Handle<Object> receiver = args.receiver();
   if (!EnsureJSArrayWithWritableFastElements(isolate, receiver, &args, 3) ||
       // If this is a subclass of Array, then call out to JS.
-      !JSArray::cast(*receiver)->map()->new_target_is_base() ||
+      !receiver->IsJSArray() ||

[adamk, 2016/05/03 00:45:31]

The old code just casted directly here, I think because the || above ensures
that this is a JSArray already.

[Dan Ehrenberg, 2016/05/04 00:18:50]

Oops, done

+      !Handle<JSArray>::cast(receiver)->HasArrayPrototype(isolate) ||
       // If anything with @@species has been messed with, call out to JS.
       !isolate->IsArraySpeciesLookupChainIntact()) {
     return CallJsIntrinsic(isolate, isolate->array_splice(), args);