[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/heap/heap.h

Index: src/heap/heap.h
diff --git a/src/heap/heap.h b/src/heap/heap.h
index c9f79bb761f9b433c5bda4f8e834edd386114c7a..02cb60ce920476c5fcdc5cac53cb9ace30f05086 100644
--- a/src/heap/heap.h
+++ b/src/heap/heap.h
@@ -166,6 +166,7 @@ using v8::MemoryPressureLevel;
   V(PropertyCell, has_instance_protector, HasInstanceProtector)                \
   V(Cell, species_protector, SpeciesProtector)                                 \
   V(PropertyCell, string_length_protector, StringLengthProtector)              \
+  V(PropertyCell, array_iterator_protector, ArrayIteratorProtector)            \

[Benedikt Meurer, 2016/11/08 08:30:00]

Since you don't add code dependencies on this protector, a simple Cell is
sufficient.

[caitp, 2016/11/08 17:53:07]

done (got rid of the runtime call, since nothing gets deopt-ed when it changes)

   /* Special numbers */                                                        \
   V(HeapNumber, nan_value, NanValue)                                           \
   V(HeapNumber, hole_nan_value, HoleNanValue)                                  \