Make __proto__ a foreign callback on Object.prototype.

test/mjsunit/builtins.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 36 matching lines @@
   if (propNames.length == 0 ||
       (propNames.length == 1 && propNames[0] == "constructor")) {
     // Not a constructor.
     return;
   }
   var proto_desc = Object.getOwnPropertyDescriptor(func, "prototype");
   assertTrue(proto_desc.hasOwnProperty("value"), name);
   assertFalse(proto_desc.writable, name);
   assertFalse(proto_desc.configurable, name);
   var prototype = proto_desc.value;
-  assertEquals(null, prototype.__proto__, name);
+  assertEquals(null, Object.getPrototypeOf(prototype), name);
   for (var i = 0; i < propNames.length; i++) {
     var propName = propNames[i];
     if (propName == "constructor") continue;
     var testName = name + "-" + propName;
     var propDesc = Object.getOwnPropertyDescriptor(prototype, propName);
     assertTrue(propDesc.hasOwnProperty("value"), testName);
     assertFalse(propDesc.configurable, testName);
     if (isFunction(propDesc.value)) {
       assertFalse(propDesc.writable, testName);
     }
   }
 }
 
 for (var i = 0; i < names.length; i++) {
   var name = names[i];
   var desc = Object.getOwnPropertyDescriptor(builtins, name);
   assertTrue(desc.hasOwnProperty("value"));
   var value = desc.value;
   if (isFunction(value)) {
     checkConstructor(value, name);
   }
 }