Ensure slow properties for simple {__proto__:null} literals.

src/factory.h

Index: src/factory.h
diff --git a/src/factory.h b/src/factory.h
index 7267cbf3a0334cc291331ea8895dd3d4842b6a8e..1e70ea605bc5ffb4ecf841377d7acc50996d68ff 100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -478,6 +478,10 @@ class V8_EXPORT_PRIVATE Factory final {
       Handle<Map> map,
       PretenureFlag pretenure = NOT_TENURED,
       Handle<AllocationSite> allocation_site = Handle<AllocationSite>::null());
+  Handle<JSObject> NewSlowJSObjectFromMap(
+      Handle<Map> map,
+      int number_of_slow_properties = NameDictionary::kInitialCapacity,
+      PretenureFlag pretenure = NOT_TENURED);
 
   // JS arrays are pretenured when allocated by the parser.
 
@@ -769,9 +773,9 @@ class V8_EXPORT_PRIVATE Factory final {
 
   // Return a map for given number of properties using the map cache in the
   // native context.
-  Handle<Map> ObjectLiteralMapFromCache(Handle<Context> context,
+  Handle<Map> ObjectLiteralMapFromCache(Handle<Context> native_context,
                                         int number_of_properties,
-                                        bool* is_result_from_cache);
+                                        bool use_null_prototype);
 
   Handle<RegExpMatchInfo> NewRegExpMatchInfo();