Pass in the map while creating JSFunction, and set prototype in the client.

src/factory.h

Index: src/factory.h
diff --git a/src/factory.h b/src/factory.h
index a525fd1e4b56853a9dcf25605a2383e68e8dad94..91a036cca79583e13752764fe964fbba3101a0aa 100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -676,13 +676,12 @@ class Factory V8_FINAL {
   // type JS_FUNCTION_TYPE benefit from the use of this function.
   inline void InitializeFunction(Handle<JSFunction> function,
                                  Handle<SharedFunctionInfo> info,
-                                 Handle<Context> context,
-                                 MaybeHandle<Object> maybe_prototype);
+                                 Handle<Context> context);
 
   // Creates a function initialized with a shared part.
-  inline Handle<JSFunction> NewFunction(Handle<SharedFunctionInfo> info,
+  inline Handle<JSFunction> NewFunction(Handle<Map> map,
+                                        Handle<SharedFunctionInfo> info,
                                         Handle<Context> context,
-                                        MaybeHandle<Object> maybe_prototype,
                                         PretenureFlag pretenure = TENURED);
 
   // Create a new map cache.