Remove [[PROTOTYPE]] from ObjectToStringHarmony

src/harmony-tostring.js

Index: src/harmony-tostring.js
diff --git a/src/harmony-tostring.js b/src/harmony-tostring.js
index 282b3a0ffbd23c3a2aa3feaf72144aa07b4143b0..41a84dff6e0079a6ef953f522bf4820c7818742b 100644
--- a/src/harmony-tostring.js
+++ b/src/harmony-tostring.js
@@ -56,11 +56,19 @@ HarmonyToStringExtendSymbolPrototype();
 function HarmonyToStringExtendObjectPrototype() {
   %CheckIsBootstrapping();
 
+  // Can't use InstallFunctions() because will fail in Debug mode.
+  // Emulate InstallFunctions() here.
+  %FunctionSetName(ObjectToStringHarmony, "toString");
+  %FunctionRemovePrototype(ObjectToStringHarmony);
+  %SetNativeFlag(ObjectToStringHarmony);
+
   // Set up the non-enumerable functions on the Array prototype object.
   var desc = ToPropertyDescriptor({
     value: ObjectToStringHarmony
   });
   DefineOwnProperty($Object.prototype, "toString", desc, false);
+
+  %ToFastProperties($Object.prototype);
 }
 
 HarmonyToStringExtendObjectPrototype();