The Species protector should be a property cell.

To be able to use this in optimized code dependency relationships.

Bug: 
Change-Id: Ia099a68994b1252de3c72c8d688862ca17ca76d9
Reviewed-on: https://chromium-review.googlesource.com/548716
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46277}

src/builtins/builtins-array-gen.cc

@@ -755,7 +755,8 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
     GotoIf(WordNotEqual(proto, initial_array_prototype), &runtime);
 
     Node* species_protector = SpeciesProtectorConstant();
-    Node* value = LoadObjectField(species_protector, Cell::kValueOffset);
+    Node* value =
+        LoadObjectField(species_protector, PropertyCell::kValueOffset);
     Node* const protector_invalid = SmiConstant(Isolate::kProtectorInvalid);
     GotoIf(WordEqual(value, protector_invalid), &runtime);
 

src/heap/heap.cc

@@ -2859,9 +2859,9 @@ void Heap::CreateInitialObjects() {
       handle(Smi::FromInt(Isolate::kProtectorValid), isolate()));
   set_is_concat_spreadable_protector(*is_concat_spreadable_cell);
 
-  Handle<Cell> species_cell = factory->NewCell(
-      handle(Smi::FromInt(Isolate::kProtectorValid), isolate()));
-  set_species_protector(*species_cell);
+  cell = factory->NewPropertyCell(factory->empty_string());
+  cell->set_value(Smi::FromInt(Isolate::kProtectorValid));
+  set_species_protector(*cell);
 
   cell = factory->NewPropertyCell(factory->empty_string());
   cell->set_value(Smi::FromInt(Isolate::kProtectorValid));

src/heap/heap.h

@@ -173,7 +173,7 @@ using v8::MemoryPressureLevel;
   /* Protectors */                                                             \
   V(PropertyCell, array_protector, ArrayProtector)                             \
   V(Cell, is_concat_spreadable_protector, IsConcatSpreadableProtector)         \
-  V(Cell, species_protector, SpeciesProtector)                                 \
+  V(PropertyCell, species_protector, SpeciesProtector)                         \
   V(PropertyCell, string_length_protector, StringLengthProtector)              \
   V(Cell, fast_array_iteration_protector, FastArrayIterationProtector)         \
   V(PropertyCell, array_iterator_protector, ArrayIteratorProtector)            \

src/isolate-inl.h

@@ -128,7 +128,7 @@ bool Isolate::IsArraySpeciesLookupChainIntact() {
   // done here. In place, there are mjsunit tests harmony/array-species* which
   // ensure that behavior is correct in various invalid protector cases.
 
-  Cell* species_cell = heap()->species_protector();
+  PropertyCell* species_cell = heap()->species_protector();
   return species_cell->value()->IsSmi() &&
          Smi::cast(species_cell->value())->value() == kProtectorValid;
 }

tools/v8heapconst.py

@@ -301,13 +301,13 @@ KNOWN_OBJECTS = {
   ("OLD_SPACE", 0x028c9): "ArrayProtector",
   ("OLD_SPACE", 0x028f1): "IsConcatSpreadableProtector",
   ("OLD_SPACE", 0x02901): "SpeciesProtector",
-  ("OLD_SPACE", 0x02911): "StringLengthProtector",
-  ("OLD_SPACE", 0x02939): "FastArrayIterationProtector",
-  ("OLD_SPACE", 0x02949): "ArrayIteratorProtector",
-  ("OLD_SPACE", 0x02971): "ArrayBufferNeuteringProtector",
-  ("OLD_SPACE", 0x02999): "InfinityValue",
-  ("OLD_SPACE", 0x029a9): "MinusZeroValue",
-  ("OLD_SPACE", 0x029b9): "MinusInfinityValue",
+  ("OLD_SPACE", 0x02929): "StringLengthProtector",
+  ("OLD_SPACE", 0x02951): "FastArrayIterationProtector",
+  ("OLD_SPACE", 0x02961): "ArrayIteratorProtector",
+  ("OLD_SPACE", 0x02989): "ArrayBufferNeuteringProtector",
+  ("OLD_SPACE", 0x029b1): "InfinityValue",
+  ("OLD_SPACE", 0x029c1): "MinusZeroValue",
+  ("OLD_SPACE", 0x029d1): "MinusInfinityValue",
 }
 
 # List of known V8 Frame Markers.