Make array __proto__ manipulations not disturb the species protector

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 4bdfe5e1a6de3db64c5d9de5519e0899f6544e8b..c1a6aa4eed069b218d78579d1edf9a6c044f628a 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -698,7 +698,7 @@ BUILTIN(ArraySlice) {
         !IsJSArrayFastElementMovingAllowed(isolate, array) ||
         !isolate->IsArraySpeciesLookupChainIntact() ||
         // If this is a subclass of Array, then call out to JS
-        !array->map()->new_target_is_base()) {
+        !array->HasArrayPrototype(isolate)) {
       AllowHeapAllocation allow_allocation;
       return CallJsIntrinsic(isolate, isolate->array_slice(), args);
     }
@@ -759,7 +759,7 @@ BUILTIN(ArraySplice) {
   Handle<Object> receiver = args.receiver();
   if (!EnsureJSArrayWithWritableFastElements(isolate, receiver, &args, 3) ||
       // If this is a subclass of Array, then call out to JS.
-      !JSArray::cast(*receiver)->map()->new_target_is_base() ||
+      !Handle<JSArray>::cast(receiver)->HasArrayPrototype(isolate) ||
       // If anything with @@species has been messed with, call out to JS.
       !isolate->IsArraySpeciesLookupChainIntact()) {
     return CallJsIntrinsic(isolate, isolate->array_splice(), args);