[es6] Function bind should preserve [[Prototype]]

src/runtime/runtime-function.cc

Index: src/runtime/runtime-function.cc
diff --git a/src/runtime/runtime-function.cc b/src/runtime/runtime-function.cc
index d644d37e42b2fff45685eb2c7604c5c68c801a3d..e7cffc1768a4a232d1c55fbe8fe13603bdded7f8 100644
--- a/src/runtime/runtime-function.cc
+++ b/src/runtime/runtime-function.cc
@@ -443,9 +443,14 @@ RUNTIME_FUNCTION(Runtime_FunctionBindArguments) {
   // Update length. Have to remove the prototype first so that map migration
   // is happy about the number of fields.
   RUNTIME_ASSERT(bound_function->RemovePrototype());
-  Handle<Map> bound_function_map(
-      isolate->native_context()->bound_function_map());
+
+  // The new function should have the same [[Prototype]] as the bindee.
+  Handle<Map> bound_function_map = Map::Copy(

[adamk, 2015/07/01 19:31:55]

Forcing map creation here seems possibly bad. If you bind the same function over
and over again this'll create a plethora of new maps.

Can you use Map::TransitionToPrototype() here instead?

[arv (Not doing code reviews), 2015/07/01 19:51:21]

Done.

+      handle(isolate->native_context()->bound_function_map()), "FunctionBind");
+  PrototypeIterator iter(isolate, bindee);
+  Map::SetPrototype(bound_function_map, PrototypeIterator::GetCurrent(iter));
   JSObject::MigrateToMap(bound_function, bound_function_map);
+
   Handle<String> length_string = isolate->factory()->length_string();
   PropertyAttributes attr =
       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);