Ensure slow properties for simple {__proto__:null} literals.

src/factory.h

Index: src/factory.h
diff --git a/src/factory.h b/src/factory.h
index 7267cbf3a0334cc291331ea8895dd3d4842b6a8e..c2fd4003a998df966bb81e5f5b445c68ac873320 100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -478,6 +478,10 @@ class V8_EXPORT_PRIVATE Factory final {
       Handle<Map> map,
       PretenureFlag pretenure = NOT_TENURED,
       Handle<AllocationSite> allocation_site = Handle<AllocationSite>::null());
+  Handle<JSObject> NewSlowJSObjectFromMap(
+      Handle<Map> map,
+      int number_of_slow_properties = NameDictionary::kInitialCapacity,
+      PretenureFlag pretenure = NOT_TENURED);
 
   // JS arrays are pretenured when allocated by the parser.
 
@@ -769,9 +773,8 @@ class V8_EXPORT_PRIVATE Factory final {
 
   // Return a map for given number of properties using the map cache in the
   // native context.
-  Handle<Map> ObjectLiteralMapFromCache(Handle<Context> context,
-                                        int number_of_properties,
-                                        bool* is_result_from_cache);
+  Handle<Map> ObjectLiteralMapFromCache(Handle<Context> native_context,
+                                        int number_of_properties);
 
   Handle<RegExpMatchInfo> NewRegExpMatchInfo();