Make array __proto__ manipulations not disturb the species protector

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index 60a140b79c58f0fda45e1126dc97d0669ed142c0..9f6bc04b56813195bbe4fd2bcd4ae4fe29dd799a 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -22,6 +22,7 @@
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap.h"
 #include "src/isolate.h"
+#include "src/isolate-inl.h"
 #include "src/layout-descriptor-inl.h"
 #include "src/lookup.h"
 #include "src/objects.h"
@@ -2261,7 +2262,6 @@ void Struct::InitializeBody(int object_size) {
   }
 }
 
-
 bool Object::ToArrayLength(uint32_t* index) { return Object::ToUint32(index); }
 
 
@@ -7586,6 +7586,11 @@ void JSArray::SetContent(Handle<JSArray> array,
 }
 
 
+bool JSArray::HasArrayPrototype(Isolate* isolate) {
+  return map()->prototype() == *isolate->initial_array_prototype();
+}
+
+
 int TypeFeedbackInfo::ic_total_count() {
   int current = Smi::cast(READ_FIELD(this, kStorage1Offset))->value();
   return ICTotalCountField::decode(current);