Make __proto__ a foreign callback on Object.prototype.

test/mjsunit/regress/regress-2441.js

Index: test/mjsunit/regress/regress-2441.js
diff --git a/test/mjsunit/regress/regress-crbug-170856.js b/test/mjsunit/regress/regress-2441.js
similarity index 88%
copy from test/mjsunit/regress/regress-crbug-170856.js
copy to test/mjsunit/regress/regress-2441.js
index 2e73b12caaf78c8b070c243ee79d3b8e557ad97d..72ce2484ceb56487970ae1e865e4ff007fd63387 100644
--- a/test/mjsunit/regress/regress-crbug-170856.js
+++ b/test/mjsunit/regress/regress-2441.js
@@ -25,9 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-r = new RegExp("a");
-for (var i = 0; i < 100; i++) {
-  r["abc" + i] = i;
-}
-"zzzz".replace(r, "");
-assertEquals(0, r.lastIndex);
+var o = {};
+Object.preventExtensions(o);
+assertThrows("Object.defineProperty(o, 'foobarloo', {value:{}});", TypeError);
+assertThrows("Object.defineProperty(o, '__proto__', {value:{}});", TypeError);