Mark maps having a hidden prototype rather than maps of hidden prototypes.

src/debug/debug-evaluate.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/debug/debug-evaluate.h"
 
 #include "src/accessors.h"
 #include "src/contexts.h"
 #include "src/debug/debug.h"
 #include "src/debug/debug-frames.h"
@@ skipping 93 matching lines @@
                              Object);
 
   Handle<Object> result;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, result, Execution::Call(isolate, eval_fun, receiver, 0, NULL),
       Object);
 
   // Skip the global proxy as it has no properties and always delegates to the
   // real global object.
   if (result->IsJSGlobalProxy()) {
-    PrototypeIterator iter(isolate, result);
+    PrototypeIterator iter(isolate, Handle<JSGlobalProxy>::cast(result));
     // TODO(verwaest): This will crash when the global proxy is detached.
     result = PrototypeIterator::GetCurrent<JSObject>(iter);
   }
 
   return result;
 }
 
 
 DebugEvaluate::ContextBuilder::ContextBuilder(Isolate* isolate,
                                               JavaScriptFrame* frame,
@@ skipping 273 matching lines @@
     LoadFromContext(lookup_context, this_string, &global).ToHandle(&receiver);
   } else if (local_function->shared()->scope_info()->HasReceiver()) {
     receiver = handle(frame_->receiver(), isolate_);
   }
   return isolate_->factory()->NewCatchContext(global_function, parent_context,
                                               this_string, receiver);
 }
 
 }  // namespace internal
 }  // namespace v8