[es2015] Remove the @@hasInstance protector cell.

src/builtins/builtins.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_BUILTINS_BUILTINS_H_
 #define V8_BUILTINS_BUILTINS_H_
 
 #include "src/base/flags.h"
 #include "src/globals.h"
 
@@ skipping 623 matching lines @@
   CPP(ObjectLookupSetter)                                                      \
   CPP(ObjectPreventExtensions)                                                 \
   /* ES6 section 19.1.3.6 Object.prototype.toString () */                      \
   TFJ(ObjectProtoToString, 0)                                                  \
   CPP(ObjectPrototypePropertyIsEnumerable)                                     \
   CPP(ObjectPrototypeGetProto)                                                 \
   CPP(ObjectPrototypeSetProto)                                                 \
   CPP(ObjectSeal)                                                              \
   CPP(ObjectValues)                                                            \
                                                                                \
+  /* instanceof */                                                             \
+  TFS(OrdinaryHasInstance, BUILTIN, kNoExtraICState, Compare, 1)               \
   TFS(InstanceOf, BUILTIN, kNoExtraICState, Compare, 1)                        \
-  TFS(OrdinaryHasInstance, BUILTIN, kNoExtraICState, Compare, 1)               \
+                                                                               \
+  /* for-in */                                                                 \
   TFS(ForInFilter, BUILTIN, kNoExtraICState, ForInFilter, 1)                   \
   TFS(ForInNext, BUILTIN, kNoExtraICState, ForInNext, 1)                       \
   TFS(ForInPrepare, BUILTIN, kNoExtraICState, ForInPrepare, 3)                 \
                                                                                \
   /* Promise */                                                                \
   TFJ(PromiseGetCapabilitiesExecutor, 2)                                       \
   TFJ(NewPromiseCapability, 2)                                                 \
   TFJ(PromiseConstructor, 1)                                                   \
   TFJ(PromiseInternalConstructor, 1)                                           \
   TFJ(IsPromise, 1)                                                            \
@@ skipping 295 matching lines @@
 
   friend class Isolate;
 
   DISALLOW_COPY_AND_ASSIGN(Builtins);
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_BUILTINS_BUILTINS_H_