Mark as prototype only after instantiating the function

test/mjsunit/fast-prototype.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 32 matching lines @@
     obj["x" + i] = 0;
   }
 }
 
 
 function DoProtoMagic(proto, set__proto__) {
   if (set__proto__) {
     (new Sub()).__proto__ = proto;
   } else {
     Sub.prototype = proto;
+    // Need to instantiate Sub to mark .prototype as prototype.
+    new Sub();
   }
 }
 
 
 function test(use_new, add_first, set__proto__, same_map_as) {
   var proto = use_new ? new Super() : {};
 
   // New object is fast.
   assertTrue(%HasFastProperties(proto));
 
@@ skipping 49 matching lines @@
   assertTrue(key == 'a');
   break;
 }
 assertFalse(%HasFastProperties(x));
 x.d = 4;
 assertFalse(%HasFastProperties(x));
 for (key in x) {
   assertTrue(key == 'a');
   break;
 }