Remove [[PROTOTYPE]] from ObjectToStringHarmony

src/harmony-tostring.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 'use strict';
 
 // This file relies on the fact that the following declaration has been made
 // in runtime.js and symbol.js:
 // var $Object = global.Object;
 // var $Symbol = global.Symbol;
@@ skipping 38 matching lines @@
     // TODO(dslomov, caitp): Move to symbol.js when shipping
    "toStringTag", symbolToStringTag
   ));
 }
 
 HarmonyToStringExtendSymbolPrototype();
 
 function HarmonyToStringExtendObjectPrototype() {
   %CheckIsBootstrapping();
 
+  // Can't use InstallFunctions() because will fail in Debug mode.
+  // Emulate InstallFunctions() here.
+  %FunctionSetName(ObjectToStringHarmony, "toString");
+  %FunctionRemovePrototype(ObjectToStringHarmony);
+  %SetNativeFlag(ObjectToStringHarmony);
+
   // Set up the non-enumerable functions on the Array prototype object.
   var desc = ToPropertyDescriptor({
     value: ObjectToStringHarmony
   });
   DefineOwnProperty($Object.prototype, "toString", desc, false);
+
+  %ToFastProperties($Object.prototype);
 }
 
 HarmonyToStringExtendObjectPrototype();