Do not use js builtins object to determine whether a function is a builtin.

src/debug/debug.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/debug/debug.h"
 
 #include "src/api.h"
 #include "src/arguments.h"
 #include "src/bootstrapper.h"
 #include "src/code-stubs.h"
@@ skipping 2259 matching lines @@
   if (!is_active()) return;
 
   StackLimitCheck check(isolate_);
   if (check.HasOverflowed()) return;
 
   { JavaScriptFrameIterator it(isolate_);
     DCHECK(!it.done());
     Object* fun = it.frame()->function();
     if (fun && fun->IsJSFunction()) {
       // Don't stop in builtin functions.
-      if (JSFunction::cast(fun)->IsBuiltin()) return;
+      if (!JSFunction::cast(fun)->IsSubjectToDebugging()) return;
       GlobalObject* global = JSFunction::cast(fun)->context()->global_object();
       // Don't stop in debugger functions.
       if (IsDebugGlobal(global)) return;
     }
   }
 
   // Collect the break state before clearing the flags.
   bool debug_command_only = isolate_->stack_guard()->CheckDebugCommand() &&
                             !isolate_->stack_guard()->CheckDebugBreak();
 
@@ skipping 322 matching lines @@
 }
 
 
 void LockingCommandMessageQueue::Clear() {
   base::LockGuard<base::Mutex> lock_guard(&mutex_);
   queue_.Clear();
 }
 
 }  // namespace internal
 }  // namespace v8