Make __proto__ a foreign callback on Object.prototype.

src/bootstrapper.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 460 matching lines @@
     Handle<JSFunction> object_fun =
         factory->NewFunction(object_name, factory->null_value());
     Handle<Map> object_function_map =
         factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
     object_fun->set_initial_map(*object_function_map);
     object_function_map->set_constructor(*object_fun);
 
     native_context()->set_object_function(*object_fun);
 
     // Allocate a new prototype for the object function.
-    Handle<JSObject> prototype = factory->NewJSObject(
-        isolate->object_function(),
+    Handle<Map> object_prototype_map =
+        factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+    Handle<DescriptorArray> prototype_descriptors(
+        factory->NewDescriptorArray(0, 1));
+    DescriptorArray::WhitenessWitness witness(*prototype_descriptors);
+
+    Handle<Foreign> object_prototype(
+        factory->NewForeign(&Accessors::ObjectPrototype));
+    PropertyAttributes attribs = static_cast<PropertyAttributes>(
+        DONT_ENUM | DONT_DELETE);
+    object_prototype_map->set_instance_descriptors(*prototype_descriptors);
+
+    {  // Add __proto__.
+      CallbacksDescriptor d(heap->Proto_symbol(), *object_prototype, attribs);
+      object_prototype_map->AppendDescriptor(&d, witness);
+    }
+
+    Handle<JSObject> prototype = factory->NewJSObjectFromMap(
+        object_prototype_map,
         TENURED);
-
     native_context()->set_initial_object_prototype(*prototype);
     SetPrototype(object_fun, prototype);
   }
 
   // Allocate the empty function as the prototype for function ECMAScript
   // 262 15.3.4.
   Handle<String> symbol =
       factory->LookupOneByteSymbol(STATIC_ASCII_VECTOR("Empty"));
   Handle<JSFunction> empty_function =
       factory->NewFunctionWithoutPrototype(symbol, CLASSIC_MODE);
@@ skipping 1934 matching lines @@
   return from + sizeof(NestingCounterType);
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   ASSERT(!IsActive());
 }
 
 } }  // namespace v8::internal