Mark as prototype only after instantiating the function

src/factory.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/factory.h"
 
 #include "src/allocation-site-scopes.h"
 #include "src/conversions.h"
 #include "src/isolate-inl.h"
 #include "src/macro-assembler.h"
@@ skipping 1250 matching lines @@
 
 
 Handle<JSFunction> Factory::NewFunction(Handle<String> name,
                                         Handle<Code> code,
                                         Handle<Object> prototype,
                                         bool read_only_prototype) {
   Handle<Map> map = read_only_prototype
       ? isolate()->sloppy_function_with_readonly_prototype_map()
       : isolate()->sloppy_function_map();
   Handle<JSFunction> result = NewFunction(map, name, code);
-  if (!prototype->IsTheHole()) {
-    Handle<JSObject> js_proto = Handle<JSObject>::cast(prototype);
-    Handle<Map> new_map = Map::CopyAsPrototypeMap(handle(js_proto->map()));
-    JSObject::MigrateToMap(js_proto, new_map);
-  }
   result->set_prototype_or_initial_map(*prototype);
   return result;
 }
 
 
 Handle<JSFunction> Factory::NewFunction(Handle<String> name,
                                         Handle<Code> code,
                                         Handle<Object> prototype,
                                         InstanceType type,
                                         int instance_size,
                                         bool read_only_prototype) {
   // Allocate the function
   Handle<JSFunction> function = NewFunction(
       name, code, prototype, read_only_prototype);
 
   Handle<Map> initial_map = NewMap(
       type, instance_size, GetInitialFastElementsKind());
   if (prototype->IsTheHole() && !function->shared()->is_generator()) {
     prototype = NewFunctionPrototype(function);
   }
+
   initial_map->set_prototype(*prototype);
-  function->set_initial_map(*initial_map);
-  initial_map->set_constructor(*function);
+  JSFunction::SetInitialMap(function, initial_map);
 
   return function;
 }
 
 
 Handle<JSFunction> Factory::NewFunction(Handle<String> name,
                                         Handle<Code> code,
                                         InstanceType type,
                                         int instance_size) {
   return NewFunction(name, code, the_hole_value(), type, instance_size);
 }
 
 
 Handle<JSObject> Factory::NewFunctionPrototype(Handle<JSFunction> function) {
   // Make sure to use globals from the function's context, since the function
   // can be from a different context.
   Handle<Context> native_context(function->context()->native_context());
   Handle<Map> new_map;
   if (function->shared()->is_generator()) {
     // Generator prototypes can share maps since they don't have "constructor"
     // properties.
     new_map = handle(native_context->generator_object_prototype_map());
   } else {
     // Each function prototype gets a fresh map to avoid unwanted sharing of
     // maps between prototypes of different constructors.
     Handle<JSFunction> object_function(native_context->object_function());
     DCHECK(object_function->has_initial_map());
-    new_map = Map::CopyAsPrototypeMap(handle(object_function->initial_map()));
+    new_map = handle(object_function->initial_map());
   }
 
   Handle<JSObject> prototype = NewJSObjectFromMap(new_map);
 
   if (!function->shared()->is_generator()) {
     JSObject::AddProperty(prototype, constructor_string(), function, DONT_ENUM);
   }
 
   return prototype;
 }
@@ skipping 1033 matching lines @@
   return Handle<Object>::null();
 }
 
 
 Handle<Object> Factory::ToBoolean(bool value) {
   return value ? true_value() : false_value();
 }
 
 
 } }  // namespace v8::internal