Make sure builtin functions don't rely on __proto__.

src/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 867 matching lines @@
         from = high_start;
       }
     }
   };
 
   // Copy elements in the range 0..length from obj's prototype chain
   // to obj itself, if obj has holes. Return one more than the maximal index
   // of a prototype property.
   var CopyFromPrototype = function CopyFromPrototype(obj, length) {
     var max = 0;
-    for (var proto = obj.__proto__; proto; proto = proto.__proto__) {
+    for (var proto = %GetPrototype(obj); proto; proto = %GetPrototype(proto)) {
       var indices = %GetArrayKeys(proto, length);
       if (indices.length > 0) {
         if (indices[0] == -1) {
           // It's an interval.
           var proto_length = indices[1];
           for (var i = 0; i < proto_length; i++) {
             if (!obj.hasOwnProperty(i) && proto.hasOwnProperty(i)) {
               obj[i] = proto[i];
               if (i >= max) { max = i + 1; }
             }
@@ skipping 10 matching lines @@
         }
       }
     }
     return max;
   };
 
   // Set a value of "undefined" on all indices in the range from..to
   // where a prototype of obj has an element. I.e., shadow all prototype
   // elements in that range.
   var ShadowPrototypeElements = function(obj, from, to) {
-    for (var proto = obj.__proto__; proto; proto = proto.__proto__) {
+    for (var proto = %GetPrototype(obj); proto; proto = %GetPrototype(proto)) {
       var indices = %GetArrayKeys(proto, to);
       if (indices.length > 0) {
         if (indices[0] == -1) {
           // It's an interval.
           var proto_length = indices[1];
           for (var i = from; i < proto_length; i++) {
             if (proto.hasOwnProperty(i)) {
               obj[i] = void 0;
             }
           }
@@ skipping 49 matching lines @@
     // of defined elements.
     if (!IS_UNDEFINED(obj[first_undefined])) first_undefined++;
     // Fill in the undefineds and the holes.  There may be a hole where
     // an undefined should be and vice versa.
     var i;
     for (i = first_undefined; i < length - num_holes; i++) {
       obj[i] = void 0;
     }
     for (i = length - num_holes; i < length; i++) {
       // For compatability with Webkit, do not expose elements in the prototype.
-      if (i in obj.__proto__) {
+      if (i in %GetPrototype(obj)) {
         obj[i] = void 0;
       } else {
         delete obj[i];
       }
     }
 
     // Return the number of defined elements.
     return first_undefined;
   };
 
@@ skipping 561 matching lines @@
   ));
 
   SetUpLockedPrototype(InternalPackedArray, $Array(), $Array(
     "join", getFunction("join", ArrayJoin),
     "pop", getFunction("pop", ArrayPop),
     "push", getFunction("push", ArrayPush)
   ));
 }
 
 SetUpArray();