Fix second half of issue 1151, the first change (r6765) only fixed FunctionGe...

src/accessors.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 449 matching lines @@
   return function->prototype();
 }
 
 
 MaybeObject* Accessors::FunctionSetPrototype(JSObject* object,
                                              Object* value,
                                              void*) {
   bool found_it = false;
   JSFunction* function = FindInPrototypeChain<JSFunction>(object, &found_it);
   if (!found_it) return Heap::undefined_value();
+  if (!function->should_have_prototype()) return Heap::undefined_value();

[Mads Ager (chromium), 2011/02/21 14:10:51]

Does the return value here have any significance? In particular, should we
return |function| here so the only thing that is different is that we don't get
a prototype property?

   if (function->has_initial_map()) {
     // If the function has allocated the initial map
     // replace it with a copy containing the new prototype.
     Object* new_map;
     { MaybeObject* maybe_new_map =
           function->initial_map()->CopyDropTransitions();
       if (!maybe_new_map->ToObject(&new_map)) return maybe_new_map;
     }
     function->set_initial_map(Map::cast(new_map));
   }
@@ skipping 404 matching lines @@
 }
 
 
 const AccessorDescriptor Accessors::ObjectPrototype = {
   ObjectGetPrototype,
   ObjectSetPrototype,
   0
 };
 
 } }  // namespace v8::internal