Ensure slow properties for simple {__proto__:null} literals.

src/factory.h

Index: src/factory.h
diff --git a/src/factory.h b/src/factory.h
index f43fd8f6009afa8004ce9dde495c8147638c1711..d10d9e7d53b49f6174b60fd5113d1bb26a4cc7de 100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -491,6 +491,10 @@ class V8_EXPORT_PRIVATE Factory final {
       Handle<Map> map,
       PretenureFlag pretenure = NOT_TENURED,
       Handle<AllocationSite> allocation_site = Handle<AllocationSite>::null());
+  Handle<JSObject> NewSlowJSObjectFromMap(
+      Handle<Map> map,
+      int number_of_slow_properties = NameDictionary::kInitialCapacity,
+      PretenureFlag pretenure = NOT_TENURED);
 
   // JS arrays are pretenured when allocated by the parser.
 
@@ -775,9 +779,9 @@ class V8_EXPORT_PRIVATE Factory final {
 
   // Return a map for given number of properties using the map cache in the
   // native context.
-  Handle<Map> ObjectLiteralMapFromCache(Handle<Context> context,
+  Handle<Map> ObjectLiteralMapFromCache(Handle<Context> native_context,
                                         int number_of_properties,
-                                        bool* is_result_from_cache);
+                                        bool use_null_prototype);
 
   Handle<RegExpMatchInfo> NewRegExpMatchInfo();