Make Array.prototype[Symbol.iterator] non-constructible.

src/js/array-iterator.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 126 matching lines @@
 utils.SetFunctionName(ArrayIteratorIterator, iteratorSymbol);
 %AddNamedProperty(ArrayIterator.prototype, toStringTagSymbol,
                   "Array Iterator", READ_ONLY | DONT_ENUM);
 
 utils.InstallFunctions(GlobalArray.prototype, DONT_ENUM, [
   // No 'values' since it breaks webcompat: http://crbug.com/409858
   'entries', ArrayEntries,
   'keys', ArrayKeys
 ]);
 
-// TODO(adam): Remove this call once 'values' is in the above
-// InstallFunctions block, as it'll be redundant.
+// TODO(adam): Remove these calls once 'values' is in the above
+// InstallFunctions block, as they'll be redundant.
 utils.SetFunctionName(ArrayValues, 'values');
+%FunctionRemovePrototype(ArrayValues);
+%SetNativeFlag(ArrayValues);
 
 %AddNamedProperty(GlobalArray.prototype, iteratorSymbol, ArrayValues,
                   DONT_ENUM);
 
 utils.InstallFunctions(GlobalTypedArray.prototype, DONT_ENUM, [
   'entries', TypedArrayEntries,
   'keys', TypedArrayKeys,
   'values', TypedArrayValues
 ]);
 %AddNamedProperty(GlobalTypedArray.prototype,
                   iteratorSymbol, TypedArrayValues, DONT_ENUM);
 
 // -------------------------------------------------------------------
 // Exports
 
 utils.Export(function(to) {
   to.ArrayValues = ArrayValues;
 });
 
 %InstallToContext(["array_values_iterator", ArrayValues]);
 
 })