Make sure builtin functions don't rely on __proto__.

src/apinatives.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 72 matching lines @@
           {} : Instantiate(prototype);
       if (flags & (1 << kReadOnlyPrototypeBit)) {
         %FunctionSetReadOnlyPrototype(fun);
       }
       %SetProperty(fun.prototype, "constructor", fun, DONT_ENUM);
       var parent = %GetTemplateField(data, kApiParentTemplateOffset);
       // Note: Do not directly use a function template as a condition, our
       // internal ToBoolean doesn't handle that!
       if (!(typeof parent === 'undefined')) {
         var parent_fun = Instantiate(parent);
-        fun.prototype.__proto__ = parent_fun.prototype;
+        %SetPrototype(fun.prototype, parent_fun.prototype);
       }
       ConfigureTemplateInstance(fun, data);
     } catch (e) {
       cache[serialNumber] = kUninitialized;
       throw e;
     }
   }
   return cache[serialNumber];
 }
 
 
 function ConfigureTemplateInstance(obj, data) {
   var properties = %GetTemplateField(data, kApiPropertyListOffset);
   if (properties) {
     // Disable access checks while instantiating the object.
     var requires_access_checks = %DisableAccessChecks(obj);
     try {
       for (var i = 0; i < properties[0]; i += 3) {
         var name = properties[i + 1];
         var prop_data = properties[i + 2];
         var attributes = properties[i + 3];
         var value = Instantiate(prop_data, name);
         %SetProperty(obj, name, value, attributes);
       }
     } finally {
       if (requires_access_checks) %EnableAccessChecks(obj);
     }
   }
 }