[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/heap/heap.h

Index: src/heap/heap.h
diff --git a/src/heap/heap.h b/src/heap/heap.h
index f4ef6953fd6352bc59b9d64726c93ec6379a7a97..2fecf2e1ddccb6bc7e72d1bedb83399f94bf912b 100644
--- a/src/heap/heap.h
+++ b/src/heap/heap.h
@@ -166,6 +166,7 @@ using v8::MemoryPressureLevel;
   V(PropertyCell, has_instance_protector, HasInstanceProtector)                \
   V(Cell, species_protector, SpeciesProtector)                                 \
   V(PropertyCell, string_length_protector, StringLengthProtector)              \
+  V(Cell, array_iterator_protector, ArrayIteratorProtector)                    \

[Benedikt Meurer, 2016/11/13 18:40:24]

Camillo suggested to rename this to something like FastArrayIterationProtector,
and use the name ArrayIteratorProtector to protect the @@iterator property on
the Array.prototype, which would be more consistent with the  other protectors.

   /* Special numbers */                                                        \
   V(HeapNumber, nan_value, NanValue)                                           \
   V(HeapNumber, hole_nan_value, HoleNanValue)                                  \