[runtime] Object.create(null) creates a slow object

src/runtime/runtime-object.cc

Index: src/runtime/runtime-object.cc
diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc
index cbb1665fed5e6c461bc51352bf5d82b63bc06553..7be70bf51bcf6728714f7130cae595c13f03b4c1 100644
--- a/src/runtime/runtime-object.cc
+++ b/src/runtime/runtime-object.cc
@@ -226,7 +226,7 @@ RUNTIME_FUNCTION(Runtime_ObjectCreate) {
                   isolate);
   if (map->prototype() != *prototype) {
     if (prototype->IsNull(isolate)) {
-      map = isolate->object_with_null_prototype_map();
+      map = isolate->slow_object_with_null_prototype_map();
     } else if (prototype->IsJSObject()) {
       Handle<JSObject> js_prototype = Handle<JSObject>::cast(prototype);
       if (!js_prototype->map()->is_prototype_map()) {
@@ -250,6 +250,12 @@ RUNTIME_FUNCTION(Runtime_ObjectCreate) {
   // Actually allocate the object.
   Handle<JSObject> object = isolate->factory()->NewJSObjectFromMap(map);
 
+  if (map->is_dictionary_map()) {
+    Handle<NameDictionary> properties =
+        NameDictionary::New(isolate, NameDictionary::kInitialCapacity);
+    object->set_properties(*properties);
+  }
+
   // Define the properties if properties was specified and is not undefined.
   Handle<Object> properties = args.at<Object>(1);
   if (!properties->IsUndefined(isolate)) {