[es2015] Remove the @@hasInstance protector cell.

test/mjsunit/regress/regress-v8-5958.js

Index: test/mjsunit/regress/regress-v8-5958.js
diff --git a/test/mjsunit/regress/regress-v8-5958.js b/test/mjsunit/regress/regress-v8-5958.js
new file mode 100644
index 0000000000000000000000000000000000000000..dc5b95db522b57faa6010e49d849ff85467a08ac
--- /dev/null
+++ b/test/mjsunit/regress/regress-v8-5958.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class A {}
+class B {}
+
+A.__proto__ = new Proxy(A.__proto__, {
+  get: function (target, property, receiver) {
+    if (property === Symbol.hasInstance) throw new B;
+  }
+});
+
+assertThrows(() => (new A) instanceof A, B);