[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/isolate.h

Index: src/isolate.h
diff --git a/src/isolate.h b/src/isolate.h
index 157c3f90215b27b6a607104d4c616d732e11c7c2..5dd94373c9564558af6905a68f880e1ebad0bd1d 100644
--- a/src/isolate.h
+++ b/src/isolate.h
@@ -995,6 +995,9 @@ class Isolate {
   bool IsIsConcatSpreadableLookupChainIntact(JSReceiver* receiver);
   inline bool IsStringLengthOverflowIntact();
 
+  // Avoid deopt loops if fast Array Iterators migrate to slow Array Iterators.
+  inline bool CanInlineArrayIterator();
+
   // On intent to set an element in object, make sure that appropriate
   // notifications occur if the set is on the elements of the array or
   // object prototype. Also ensure that changes to prototype chain between
@@ -1013,6 +1016,7 @@ class Isolate {
   void InvalidateHasInstanceProtector();
   void InvalidateIsConcatSpreadableProtector();
   void InvalidateStringLengthOverflowProtector();
+  void InvalidateArrayIteratorProtector();
 
   // Returns true if array is the initial array prototype in any native context.
   bool IsAnyInitialArrayPrototype(Handle<JSArray> array);