Make array __proto__ manipulations not disturb the species protector

test/mjsunit/harmony/array-species-proto.js

Index: test/mjsunit/harmony/array-species-proto.js
diff --git a/test/mjsunit/harmony/array-species-proto.js b/test/mjsunit/harmony/array-species-proto.js
index 077b3f5a17352c87c8cb78670e98903faee7a15f..70db75151994aa6a82464c11ab001e50226a5399 100644
--- a/test/mjsunit/harmony/array-species-proto.js
+++ b/test/mjsunit/harmony/array-species-proto.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species
+// Flags: --harmony-species --allow-natives-syntax
 
 // Overwriting an array instance's __proto__ updates the protector
 
@@ -18,6 +18,7 @@ assertEquals(1, x.concat([1])[0]);
 class MyArray extends Array { }
 
 x.__proto__ = MyArray.prototype;
+assertTrue(%SpeciesProtector());
 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);