Tag all prototypes as proto, except those set using __proto__

src/factory.cc

Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index a52b95719db05276362f7325ec32be751b37d87a..042cf84c8471a79c4b8b8b069c85e853a59408e8 100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -1289,8 +1289,8 @@ Handle<JSFunction> Factory::NewFunction(Handle<String> name,
     prototype = NewFunctionPrototype(function);
   }
 
-  initial_map->set_prototype(*prototype);
-  JSFunction::SetInitialMap(function, initial_map);
+  JSFunction::SetInitialMap(function, initial_map,
+                            Handle<JSReceiver>::cast(prototype));
 
   return function;
 }
@@ -1321,6 +1321,7 @@ Handle<JSObject> Factory::NewFunctionPrototype(Handle<JSFunction> function) {
     new_map = handle(object_function->initial_map());
   }
 
+  DCHECK(!new_map->is_prototype_map());
   Handle<JSObject> prototype = NewJSObjectFromMap(new_map);
 
   if (!function->shared()->is_generator()) {