Fix: FunctionTemplate::SetPrototypeAttributes broke prototype object

src/apinatives.js

Index: src/apinatives.js
diff --git a/src/apinatives.js b/src/apinatives.js
index 193863f5c2f9f99cccb42432b0b6902b47898aff..df530bb0951d903fcb61fe63bdebad79e98c8b9e 100644
--- a/src/apinatives.js
+++ b/src/apinatives.js
@@ -74,13 +74,11 @@ function InstantiateFunction(data, name) {
       cache[serialNumber] = fun;
       var prototype = %GetTemplateField(data, kApiPrototypeTemplateOffset);
       var attributes = %GetTemplateField(data, kApiPrototypeAttributesOffset);
+      fun.prototype = prototype ? Instantiate(prototype) : {};
       if (attributes != NONE) {
-        %IgnoreAttributesAndSetProperty(
-            fun, "prototype",
-            prototype ? Instantiate(prototype) : {},
-            attributes);
-      } else {
-        fun.prototype = prototype ? Instantiate(prototype) : {};
+        // This will fail to set the prototype (so we can just pass in '{}'),
+        // but it *will* set its attributes :-)
+        %IgnoreAttributesAndSetProperty(fun, "prototype", {}, attributes);

[Mads Ager (chromium), 2011/07/11 10:12:54]

Let's create a runtime function %SetPropertyAttributes that changes the
attributes of a property after the fact instead of using this one.

The issue here is that the prototype property is not a normal property but an
accessor that extracts the value from a field in the map. How does the code you
had before fail?

       }
       %SetProperty(fun.prototype, "constructor", fun, DONT_ENUM);
       var parent = %GetTemplateField(data, kApiParentTemplateOffset);