Protect the emptiness of Array prototype elements with a PropertyCell.

Not just emptiness, but also a particular structure.

BUG=v8:4044
LOG=N

Review URL: https://codereview.chromium.org/1092043002

Cr-Commit-Position: refs/heads/master@{#27993}