Make sure that the prototype of the initial map is created in the...

src/heap.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1706 matching lines @@
   function->initialize_elements();
   function->set_shared(shared);
   function->set_prototype_or_initial_map(prototype);
   function->set_context(undefined_value());
   function->set_literals(empty_fixed_array(), SKIP_WRITE_BARRIER);
   return function;
 }
 
 
 Object* Heap::AllocateFunctionPrototype(JSFunction* function) {
-  // Allocate the prototype.
-  Object* prototype =
-      AllocateJSObject(Top::context()->global_context()->object_function());
+  // Allocate the prototype.  Make sure to use the object function
+  // from the function's context, since the function can be from a
+  // different context.
+  JSFunction* object_function =
+      function->context()->global_context()->object_function();
+  Object* prototype = AllocateJSObject(object_function);
   if (prototype->IsFailure()) return prototype;
   // When creating the prototype for the function we must set its
   // constructor to the function.
   Object* result =
       JSObject::cast(prototype)->SetProperty(constructor_symbol(),
                                              function,
                                              DONT_ENUM);
   if (result->IsFailure()) return result;
   return prototype;
 }
@@ skipping 1617 matching lines @@
 #ifdef DEBUG
 bool Heap::GarbageCollectionGreedyCheck() {
   ASSERT(FLAG_gc_greedy);
   if (Bootstrapper::IsActive()) return true;
   if (disallow_allocation_failure()) return true;
   return CollectGarbage(0, NEW_SPACE);
 }
 #endif
 
 } }  // namespace v8::internal