[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/heap/heap.cc

Index: src/heap/heap.cc
diff --git a/src/heap/heap.cc b/src/heap/heap.cc
index fd44ff2c97129d275da39f7b6667ff07e94fca68..8ffb3f52b9a6d27cb6b5a499baaec294c09432c9 100644
--- a/src/heap/heap.cc
+++ b/src/heap/heap.cc
@@ -2840,6 +2840,10 @@ void Heap::CreateInitialObjects() {
   cell->set_value(Smi::FromInt(Isolate::kArrayProtectorValid));
   set_string_length_protector(*cell);
 
+  Handle<Cell> array_iterator_cell = factory->NewCell(
+      handle(Smi::FromInt(Isolate::kArrayProtectorValid), isolate()));
+  set_array_iterator_protector(*array_iterator_cell);
+
   set_serialized_templates(empty_fixed_array());
 
   set_weak_stack_trace_list(Smi::kZero);