Make sure builtin functions don't rely on __proto__.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 53b5ce1c4eeb8ea71eb74f4cf235ce5efd3a3ac0..e914a3ae3291ee411b2c3a80122b2725c507fd90 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -967,6 +967,15 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_GetPrototype) {
 }
 
 
+RUNTIME_FUNCTION(MaybeObject*, Runtime_SetPrototype) {
+  NoHandleAllocation ha(isolate);
+  ASSERT(args.length() == 2);
+  CONVERT_ARG_CHECKED(JSReceiver, input_obj, 0);
+  CONVERT_ARG_CHECKED(Object, prototype, 1);
+  return input_obj->SetPrototype(prototype, true);
+}
+
+
 RUNTIME_FUNCTION(MaybeObject*, Runtime_IsInPrototypeChain) {
   NoHandleAllocation ha(isolate);
   ASSERT(args.length() == 2);