Fix set-up of intrinsics' 'constructor' properties

src/v8natives.js

Index: src/v8natives.js
diff --git a/src/v8natives.js b/src/v8natives.js
index 5f870c8208f7c2add547a7d5ab378e11498958e8..6c9b30d5e5cae21e38c2fe133d07f80c3c6e572c 100644
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -239,8 +239,6 @@ SetUpGlobal();
 // ----------------------------------------------------------------------------
 // Object
 
-$Object.prototype.constructor = $Object;
-
 // ECMA-262 - 15.2.4.2
 function ObjectToString() {
   if (IS_UNDEFINED(this) && !IS_UNDETECTABLE(this)) return "[object Undefined]";
@@ -1378,6 +1376,8 @@ function SetUpObject() {
   %FunctionRemovePrototype(ObjectPoisonProto);
   %SetExpectedNumberOfProperties($Object, 4);
 
+  %SetProperty($Object.prototype, "constructor", $Object, DONT_ENUM);
+
   // Set up non-enumerable functions on the Object.prototype object.
   InstallFunctions($Object.prototype, DONT_ENUM, $Array(
     "toString", ObjectToString,
@@ -1659,8 +1659,6 @@ SetUpNumber();
 // ----------------------------------------------------------------------------
 // Function
 
-$Function.prototype.constructor = $Function;
-
 function FunctionSourceString(func) {
   while (%IsJSFunctionProxy(func)) {
     func = %GetCallTrap(func);
@@ -1790,6 +1788,7 @@ function NewFunction(arg1) {  // length == 1
 
 function SetUpFunction() {
   %CheckIsBootstrapping();
+  %SetProperty($Function.prototype, "constructor", $Function, DONT_ENUM);
   InstallFunctions($Function.prototype, DONT_ENUM, $Array(
     "bind", FunctionBind,
     "toString", FunctionToString