Fix DebugEvaluate on properties defined on Object.prototype

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index f5789f68d92b796f5f2a07fcb2510f41efa321ad..3ecf04430a82632a615aab7f097f97a0959cda8d 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -13007,6 +13007,16 @@ static MaybeHandle<Object> DebugEvaluate(Isolate* isolate,
 }
 
 
+static Handle<JSObject> NewJSObjectWithNullProto(Isolate* isolate) {
+  Handle<JSObject> result =
+      isolate->factory()->NewJSObject(isolate->object_function());
+  Handle<Map> new_map = Map::Copy(Handle<Map>(result->map()));
+  new_map->set_prototype(*isolate->factory()->null_value());
+  JSObject::MigrateToMap(result, new_map);
+  return result;
+}
+
+
 // Evaluate a piece of JavaScript in the context of a stack frame for
 // debugging.  Things that need special attention are:
 // - Parameters and stack-allocated locals need to be materialized.  Altered
@@ -13049,8 +13059,7 @@ RUNTIME_FUNCTION(Runtime_DebugEvaluate) {
   DCHECK(!context.is_null());
 
   // Materialize stack locals and the arguments object.
-  Handle<JSObject> materialized =
-      isolate->factory()->NewJSObject(isolate->object_function());
+  Handle<JSObject> materialized = NewJSObjectWithNullProto(isolate);
 
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, materialized,