fix(expressions): Array.prototype[Symbol.iterator] poisoning not detected in destructuring (18 tests)

[dowdiness]

Root cause

When Array.prototype[Symbol.iterator] is replaced with a non-function (poisoned), using an array literal as a destructuring source should throw TypeError at the point where GetIterator tries to call @@iterator. The engine currently proceeds without throwing.

This affects every context that uses array destructuring: function parameters, default parameters, assignment patterns, generator methods, class methods, and arrow-function parameters.

Failure breakdown — language/expressions suite (2026-06-21)

Subcategory	Unique failing tests
class/dstr	8
function/dstr	4
object/dstr	4
generators/dstr	2
arrow-function/dstr	2
Total	18

Test files: ary-init-iter-get-err-array-prototype.js and dflt-ary-init-iter-get-err-array-prototype.js across each subcategory.

Reproducer

Object.defineProperty(Array.prototype, Symbol.iterator, { value: null });
try {
  var [x] = [1];  // should throw TypeError
  throw new Error('no exception');
} catch (e) {
  if (!(e instanceof TypeError)) throw new Error('wrong type: ' + e);
}

Fix direction

GetIterator (§7.4.2) must validate that the @@iterator method is callable before invoking it, throwing TypeError if not. The current path likely skips this check for plain arrays, bypassing the protocol.