[runtime] Simplify LookupIterator::UpdateProtector

There's no need for these extra protector checks as the actual checks
are now fast -- we don't have to compare against function objects in
every context but instead just do a very quick instance type check.

Bug: v8:11256
Change-Id: I40cdf40c8c85e39354bcbd32a7808cd083c8e45b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2598586
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72151}

src/objects/lookup.cc

@@ -184,12 +184,6 @@ void LookupIterator::InternalUpdateProtector(Isolate* isolate,
 
   ReadOnlyRoots roots(isolate);
   if (*name == roots.constructor_string()) {
-    if (!Protectors::IsArraySpeciesLookupChainIntact(isolate) &&
-        !Protectors::IsPromiseSpeciesLookupChainIntact(isolate) &&
-        !Protectors::IsRegExpSpeciesLookupChainIntact(isolate) &&
-        !Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) {
-      return;
-    }
     // Setting the constructor property could change an instance's @@species
     if (receiver->IsJSArray(isolate)) {
       if (!Protectors::IsArraySpeciesLookupChainIntact(isolate)) return;
@@ -254,12 +248,6 @@ void LookupIterator::InternalUpdateProtector(Isolate* isolate,
       Protectors::InvalidateStringIteratorLookupChain(isolate);
     }
   } else if (*name == roots.species_symbol()) {
-    if (!Protectors::IsArraySpeciesLookupChainIntact(isolate) &&
-        !Protectors::IsPromiseSpeciesLookupChainIntact(isolate) &&
-        !Protectors::IsRegExpSpeciesLookupChainIntact(isolate) &&
-        !Protectors::IsTypedArraySpeciesLookupChainIntact(isolate)) {
-      return;
-    }
     // Setting the Symbol.species property of any Array, Promise or TypedArray
     // constructor invalidates the @@species protector
     if (receiver->IsJSArrayConstructor()) {