Make array __proto__ manipulations not disturb the species protector

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 45748500939bbd7ee82cdec3b3bb621dcd5c6303..436ffbe21208ada6aa64a3558844955d930a1fac 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -10173,6 +10173,12 @@ class JSArray: public JSObject {
                                                     PropertyDescriptor* desc,
                                                     ShouldThrow should_throw);
 
+  // Checks whether the Array has the current realm's Array.prototype as its
+  // prototype. This function is best-effort and only gives a conservative
+  // approximation, erring on the side of false, in particular with respect
+  // to Proxies and objects with a hidden prototype.
+  inline bool HasArrayPrototype(Isolate* isolate);
+
   DECLARE_CAST(JSArray)
 
   // Dispatched behavior.