[es6] Function bind should preserve [[Prototype]]

src/runtime/runtime-function.cc

Index: src/runtime/runtime-function.cc
diff --git a/src/runtime/runtime-function.cc b/src/runtime/runtime-function.cc
index d644d37e42b2fff45685eb2c7604c5c68c801a3d..152c21604dc397eaa4c86bb56eba64a8db0b0546 100644
--- a/src/runtime/runtime-function.cc
+++ b/src/runtime/runtime-function.cc
@@ -443,9 +443,14 @@ RUNTIME_FUNCTION(Runtime_FunctionBindArguments) {
   // Update length. Have to remove the prototype first so that map migration
   // is happy about the number of fields.
   RUNTIME_ASSERT(bound_function->RemovePrototype());
-  Handle<Map> bound_function_map(
-      isolate->native_context()->bound_function_map());
+
+  // The new function should have the same [[Prototype]] as the bindee.
+  PrototypeIterator iter(isolate, bindee);
+  Handle<Map> bound_function_map = Map::TransitionToPrototype(

[Toon Verwaest, 2015/07/08 16:31:33]

I guess you can avoid this if bound_function_map already has the right
prototype?

[arv (Not doing code reviews), 2015/07/08 16:37:01]

Yeah, that should be the common case. I'll check for it.

+      handle(isolate->native_context()->bound_function_map()),
+      PrototypeIterator::GetCurrent(iter), REGULAR_PROTOTYPE);
   JSObject::MigrateToMap(bound_function, bound_function_map);
+
   Handle<String> length_string = isolate->factory()->length_string();
   PropertyAttributes attr =
       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);