[builtins] adapt arguments for Builtins::kIteratorPrototypeIterator

BUG=chromium:650172
R=mstarzinger@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2368323002
Cr-Commit-Position: refs/heads/master@{#39760}

src/bootstrapper.cc

@@ -663,7 +663,7 @@ void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
 
   Handle<JSFunction> iterator_prototype_iterator = SimpleCreateFunction(
       isolate(), factory()->NewStringFromAsciiChecked("[Symbol.iterator]"),
-      Builtins::kIteratorPrototypeIterator, 0, false);
+      Builtins::kIteratorPrototypeIterator, 0, true);
   iterator_prototype_iterator->shared()->set_native(true);
 
   JSObject::AddProperty(iterator_prototype, factory()->iterator_symbol(),

test/mjsunit/es6/regress/regress-650172.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var iterator = [].entries().__proto__.__proto__[Symbol.iterator];
+print(1/iterator(-1E-300));