Do not allow calls to SetProtoType on functions that should not have a protot...

src/accessors.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 429 matching lines @@
 //
 // Accessors::FunctionPrototype
 //
 
 
 MaybeObject* Accessors::FunctionGetPrototype(Object* object, void*) {
   bool found_it = false;
   JSFunction* function = FindInPrototypeChain<JSFunction>(object, &found_it);
   if (!found_it) return Heap::undefined_value();
   if (!function->has_prototype()) {
+    if (!function->should_have_prototype()) return Heap::undefined_value();
     Object* prototype;
     { MaybeObject* maybe_prototype = Heap::AllocateFunctionPrototype(function);
       if (!maybe_prototype->ToObject(&prototype)) return maybe_prototype;
     }
     Object* result;
     { MaybeObject* maybe_result = function->SetPrototype(prototype);
       if (!maybe_result->ToObject(&result)) return maybe_result;
     }
   }
   return function->prototype();
@@ skipping 423 matching lines @@
 }
 
 
 const AccessorDescriptor Accessors::ObjectPrototype = {
   ObjectGetPrototype,
   ObjectSetPrototype,
   0
 };
 
 } }  // namespace v8::internal