Fix initial prototype of WeakMap function.

src/bootstrapper.cc

Index: src/bootstrapper.cc
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 4f7cf409404e9e909aaa0bde8d36fd3b139acccf..8a78bdc5238d84eb168d575794c996612c8aff0b 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1192,15 +1192,15 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> inner_global,
 
 
 void Genesis::InitializeExperimentalGlobal() {
-  Isolate* isolate = this->isolate();
   Handle<JSObject> global = Handle<JSObject>(global_context()->global());
 
   // TODO(mstarzinger): Move this into Genesis::InitializeGlobal once we no
   // longer need to live behind a flag, so WeakMap gets added to the snapshot.
   if (FLAG_harmony_weakmaps) {  // -- W e a k M a p
+    Handle<JSObject> prototype =
+        factory()->NewJSObject(isolate()->object_function(), TENURED);
     InstallFunction(global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize,
-                    isolate->initial_object_prototype(),
-                    Builtins::kIllegal, true);
+                    prototype, Builtins::kIllegal, true);
   }
 }