Make array __proto__ manipulations not disturb the species protector

test/mjsunit/harmony/array-species-constructor-delete.js

Index: test/mjsunit/harmony/array-species-constructor-delete.js
diff --git a/test/mjsunit/harmony/array-species-constructor-delete.js b/test/mjsunit/harmony/array-species-constructor-delete.js
index e61d0ddebfc027c216ed4b9f4609b881d6cdc35a..f341282dd96f91f20944048cc8c5e0dd4efc45ab 100644
--- a/test/mjsunit/harmony/array-species-constructor-delete.js
+++ b/test/mjsunit/harmony/array-species-constructor-delete.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species
+// Flags: --harmony-species --allow-natives-syntax
 
 // Overwriting the constructor of an instance updates the protector
 
@@ -19,6 +19,7 @@ class MyArray extends Array { }
 
 Object.prototype.constructor = MyArray;
 delete Array.prototype.constructor;
+assertFalse(%SpeciesProtector());
 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);