Tag all prototypes as proto, except those set using __proto__

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 0001eb5dd4c4a889a6ea7110efc92cbe8cb0f644..4537aca0386ab465f449c8eeef8d0b22fa2e395e 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2475,9 +2475,7 @@ class JSObject: public JSReceiver {
 
   // Set the object's prototype (only JSReceiver and null are allowed values).
   MUST_USE_RESULT static MaybeHandle<Object> SetPrototype(
-      Handle<JSObject> object,
-      Handle<Object> value,
-      bool skip_hidden_prototypes = false);
+      Handle<JSObject> object, Handle<Object> value, bool from_javascript);
 
   // Initializes the body after properties slot, properties slot is
   // initialized by set_properties.  Fill the pre-allocated fields with
@@ -7780,7 +7778,8 @@ class JSFunction: public JSObject {
 
   // The initial map for an object created by this constructor.
   inline Map* initial_map();
-  static void SetInitialMap(Handle<JSFunction> function, Handle<Map> map);
+  static void SetInitialMap(Handle<JSFunction> function, Handle<Map> map,
+                            Handle<Object> prototype);
   inline bool has_initial_map();
   static void EnsureHasInitialMap(Handle<JSFunction> function);