It was a straight pass-through to JSFunction::SetPrototype, with the
added wrinkle that it appeared to sometimes throw (although it never did).

Also improves typing of JSFunction::SetInstancePrototype signature to
require being passed a JSReceiver.

Change-Id: Ie85b9a74955f72bf988cd902c5eec34e32b51a24
Reviewed-on: https://chromium-review.googlesource.com/482421Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44757}