Ensure slow properties for simple {__proto__:null} literals.

src/factory.h

Index: src/factory.h
diff --git a/src/factory.h b/src/factory.h
index f43fd8f6009afa8004ce9dde495c8147638c1711..7d5473668a313d73a2769adcbe5118146de2fa07 100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -491,6 +491,10 @@ class V8_EXPORT_PRIVATE Factory final {
       Handle<Map> map,
       PretenureFlag pretenure = NOT_TENURED,
       Handle<AllocationSite> allocation_site = Handle<AllocationSite>::null());
+  Handle<JSObject> NewSlowJSObjectFromMap(
+      Handle<Map> map,
+      int number_of_slow_properties = NameDictionary::kInitialCapacity,
+      PretenureFlag pretenure = NOT_TENURED);
 
   // JS arrays are pretenured when allocated by the parser.
 
@@ -777,6 +781,7 @@ class V8_EXPORT_PRIVATE Factory final {
   // native context.
   Handle<Map> ObjectLiteralMapFromCache(Handle<Context> context,
                                         int number_of_properties,
+                                        bool use_null_prototype,
                                         bool* is_result_from_cache);
 
   Handle<RegExpMatchInfo> NewRegExpMatchInfo();