[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/heap/heap.h

Index: src/heap/heap.h
diff --git a/src/heap/heap.h b/src/heap/heap.h
index c9f79bb761f9b433c5bda4f8e834edd386114c7a..445470b161261252d2205fd61ffb2b1017a37dbb 100644
--- a/src/heap/heap.h
+++ b/src/heap/heap.h
@@ -166,6 +166,7 @@ using v8::MemoryPressureLevel;
   V(PropertyCell, has_instance_protector, HasInstanceProtector)                \
   V(Cell, species_protector, SpeciesProtector)                                 \
   V(PropertyCell, string_length_protector, StringLengthProtector)              \
+  V(Cell, array_iterator_protector, ArrayIteratorProtector)                    \
   /* Special numbers */                                                        \
   V(HeapNumber, nan_value, NanValue)                                           \
   V(HeapNumber, hole_nan_value, HoleNanValue)                                  \
@@ -751,6 +752,9 @@ class Heap {
   }
   Object* native_contexts_list() const { return native_contexts_list_; }
 
+  // Used by CodeStubAssembler::IsInAnyContext()
+  Object** native_contexts_list_address() { return &native_contexts_list_; }
+
   void set_allocation_sites_list(Object* object) {
     allocation_sites_list_ = object;
   }