Move Array.prototype setup to bootstrapper

This lived in the JS natives for a long time, but it seems to work
just fine in the bootstrapper, and looks much cleaner there.

Change-Id: I9f5723cd840d83dde536db842b294ff1ccac294b
Reviewed-on: https://chromium-review.googlesource.com/483963Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44816}

src/bootstrapper.cc

@@ -569,10 +569,6 @@ Handle<JSFunction> Genesis::CreateEmptyFunction(Isolate* isolate) {
     object_function_prototype->set_map(*map);
 
     native_context()->set_initial_object_prototype(*object_function_prototype);
-    // For bootstrapping set the array prototype to be the same as the object
-    // prototype, otherwise the missing initial_array_prototype will cause
-    // assertions during startup.
-    native_context()->set_initial_array_prototype(*object_function_prototype);
     JSFunction::SetPrototype(object_fun, object_function_prototype);
   }
 
@@ -1478,6 +1474,13 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Handle<Code> code = array_constructor_stub.GetCode();
     array_function->shared()->SetConstructStub(*code);
 
+    // Set up %ArrayPrototype%.
+    Handle<JSArray> array_prototype =
+        Handle<JSArray>::cast(factory->NewJSObject(array_function, TENURED));
+    JSArray::Initialize(array_prototype, 0);
+    JSFunction::SetPrototype(array_function, array_prototype);
+    native_context()->set_initial_array_prototype(*array_prototype);
+
     Handle<JSFunction> is_arraylike = SimpleInstallFunction(
         array_function, isolate->factory()->InternalizeUtf8String("isArray"),
         Builtins::kArrayIsArray, 1, true);
@@ -4835,8 +4838,6 @@ bool Genesis::ConfigureGlobalObjects(
 
   JSObject::ForceSetPrototype(global_proxy, global_object);
 
-  native_context()->set_initial_array_prototype(
-      JSArray::cast(native_context()->array_function()->prototype()));
   native_context()->set_array_buffer_map(
       native_context()->array_buffer_fun()->initial_map());
   native_context()->set_js_map_map(

src/js/prologue.js

@@ -8,13 +8,6 @@
 
 %CheckIsBootstrapping();
 
-// NOTE: Setting the prototype for Array must take place as early as
-// possible due to code generation for array literals.  When
-// generating code for a array literal a boilerplate array is created
-// that is cloned when running the code.  It is essential that the
-// boilerplate gets the right prototype.
-%FunctionSetPrototype(global.Array, new global.Array(0));
-
 // -----------------------------------------------------------------------
 // Utils