Make Array.prototype[Symbol.iterator] non-constructible.

R=adamk@chromium.org
BUG=v8:5237

Review-Url: https://codereview.chromium.org/2188753002
Cr-Commit-Position: refs/heads/master@{#38116}

src/js/array-iterator.js

@@ -144,9 +144,11 @@ utils.InstallFunctions(GlobalArray.prototype, DONT_ENUM, [
   'keys', ArrayKeys
 ]);
 
-// TODO(adam): Remove this call once 'values' is in the above
-// InstallFunctions block, as it'll be redundant.
+// TODO(adam): Remove these calls once 'values' is in the above
+// InstallFunctions block, as they'll be redundant.
 utils.SetFunctionName(ArrayValues, 'values');
+%FunctionRemovePrototype(ArrayValues);
+%SetNativeFlag(ArrayValues);
 
 %AddNamedProperty(GlobalArray.prototype, iteratorSymbol, ArrayValues,
                   DONT_ENUM);

test/mjsunit/es6/array-prototype-values.js

@@ -13,3 +13,4 @@ assertTrue(valuesDesc.configurable);
 assertTrue(valuesDesc.writable);
 assertFalse(valuesDesc.enumerable);
 assertTrue(Array.prototype[Symbol.unscopables].values);
+assertThrows(() => new Array.prototype[Symbol.iterator], TypeError);