[runtime] Object.create(null) creates a slow object

test/mjsunit/es6/symbols.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 335 matching lines @@
 function TestKeyDelete(obj) {
   for (var i in symbols) {
     delete obj[symbols[i]]
   }
   for (var i in symbols) {
     assertEquals(undefined, Object.getOwnPropertyDescriptor(obj, symbols[i]))
   }
 }
 
 
-var objs = [{}, [], Object.create(null), Object(1), new Map, function(){}]
+var objs = [{}, [], Object.create({}), Object(1), new Map, function(){}]
 
 for (var i in objs) {
   var obj = objs[i]
   TestKeySet(obj)
   TestKeyDefine(obj)
   TestKeyGet(obj)
   TestKeyHas(obj)
   TestKeyEnum(obj)
   TestKeyNames(obj)
   TestGetOwnPropertySymbols(obj)
@@ skipping 192 matching lines @@
   assertEquals(JSON.stringify(input, null, "="),
                JSON.stringify(input, (key, value) => value, "="));
 }
 
 TestStringify(undefined, Symbol("a"));
 TestStringify('[{}]', [Object(Symbol())]);
 var symbol_wrapper = Object(Symbol("a"))
 TestStringify('{}', symbol_wrapper);
 symbol_wrapper.a = 1;
 TestStringify('{"a":1}', symbol_wrapper);