[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/heap/heap.cc

Index: src/heap/heap.cc
diff --git a/src/heap/heap.cc b/src/heap/heap.cc
index 3528c93f4162e26078fbff411692d0e32c21cee6..befd967994546224b30547cd0afda12e3ba342f4 100644
--- a/src/heap/heap.cc
+++ b/src/heap/heap.cc
@@ -2850,6 +2850,10 @@ void Heap::CreateInitialObjects() {
   cell->set_value(Smi::FromInt(Isolate::kArrayProtectorValid));
   set_string_length_protector(*cell);
 
+  Handle<Cell> fast_array_iteration_cell = factory->NewCell(
+      handle(Smi::FromInt(Isolate::kArrayProtectorValid), isolate()));
+  set_fast_array_iteration_protector(*fast_array_iteration_cell);
+
   set_serialized_templates(empty_fixed_array());
 
   set_weak_stack_trace_list(Smi::kZero);