Make __proto__ a real JavaScript accessor property.

test/mjsunit/regress/regress-2606.js

Index: test/mjsunit/regress/regress-2606.js
diff --git a/test/mjsunit/regress/regress-2565.js b/test/mjsunit/regress/regress-2606.js
similarity index 55%
copy from test/mjsunit/regress/regress-2565.js
copy to test/mjsunit/regress/regress-2606.js
index a77806a62e2209d355fce393b98797f1d20f40f8..b704f7d1eb44c14ba42ada0ee870ffd84fb40f9b 100644
--- a/test/mjsunit/regress/regress-2565.js
+++ b/test/mjsunit/regress/regress-2606.js
@@ -25,8 +25,37 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Check baseline for __proto__.
+var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertEquals("function", typeof desc.get);
+assertEquals("function", typeof desc.set);
+
+// Check redefining getter for __proto__.
+function replaced_get() {};
+Object.defineProperty(Object.prototype, "__proto__", { get:replaced_get });
+desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertSame(replaced_get, desc.get);
+
+// Check redefining setter for __proto__.
+function replaced_set(x) {};
+Object.defineProperty(Object.prototype, "__proto__", { set:replaced_set });
+desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertSame(replaced_set, desc.set);
+
+// Check changing configurability of __proto__.
+Object.defineProperty(Object.prototype, "__proto__", { configurable:false });
+desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertFalse(desc.configurable);
+assertSame(replaced_get, desc.get);
+assertSame(replaced_set, desc.set);
+
+// Check freezing Object.prototype completely.
 Object.freeze(Object.prototype);
-var p = {};
-var o = Object.create(p);
-assertSame(p, o.__proto__);
-assertSame(p, Object.getPrototypeOf(o));
+assertTrue(Object.isFrozen(Object.prototype));