In V8, executing the following code:
```js
Object.defineProperty(Array.prototype, Symbol.iterator, { writable: false })
```
does not actually change the value or behavior of `Array.prototype[Symbol.iterator]` (assuming the value remains the same). However, V8 still triggers `UpdateProtector` and internally calls `InvalidateArrayIteratorLookupChain`. I am not quite sure if this invalidation is necessary. This causes subsequent JIT optimizations related to array iteration to be invalidated, resulting in degraded performance.
demo:
```js
Object.defineProperty(Array.prototype, Symbol.iterator, { writable: false })
function test(...args) {
if (arguments.length > 10) return 0;
return 1 + test(1, ...args);
}
var t;
for (let k = 0; k < 10000; k += 1) {
t = test();
}
```