Make array __proto__ manipulations not disturb the species protector

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index 60a140b79c58f0fda45e1126dc97d0669ed142c0..72f7c8ad73f2c74c779ce7a66a659e4adf884a93 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -2261,7 +2261,6 @@ void Struct::InitializeBody(int object_size) {
   }
 }
 
-
 bool Object::ToArrayLength(uint32_t* index) { return Object::ToUint32(index); }
 
 
@@ -7586,6 +7585,11 @@ void JSArray::SetContent(Handle<JSArray> array,
 }
 
 
+bool JSArray::HasArrayPrototype(Isolate* isolate) {

[adamk, 2016/05/03 00:45:31]

You don't need to pass in the isolate, since JSArray already knows the Isolate.
Just call GetIsolate().

[Camillo Bruni, 2016/05/03 08:05:53]

not sure what the performance impact is though. since in the places this is used
we have the isolate at hand i don't see it that much as a problem.

+  return map()->prototype() == isolate->context()->initial_array_prototype();

[adamk, 2016/05/03 00:45:31]

This should be coming off the native_context(). But you should be able to just
use

GetIsolate()->initial_array_prototype()

(defined in a macro in isolates-inl.h)

[Dan Ehrenberg, 2016/05/04 00:18:50]

Done

+}
+
+
 int TypeFeedbackInfo::ic_total_count() {
   int current = Smi::cast(READ_FIELD(this, kStorage1Offset))->value();
   return ICTotalCountField::decode(current);