Remove [[PROTOTYPE]] from ObjectToStringHarmony

harmony-tostring needs to emulate InstallFunctions --- InstallFunctions will fail
in Debug builds because the `toString` property already exists in Object.prototype.

The fix is to add some of the other features from InstallFunctions() to the
setup of ObjectToStringHarmony.

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/667263004

Patch from Caitlin Potter <caitpotter88@gmail.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/harmony-tostring.js

@@ -56,11 +56,19 @@ HarmonyToStringExtendSymbolPrototype();
 function HarmonyToStringExtendObjectPrototype() {
   %CheckIsBootstrapping();
 
+  // Can't use InstallFunctions() because will fail in Debug mode.
+  // Emulate InstallFunctions() here.
+  %FunctionSetName(ObjectToStringHarmony, "toString");
+  %FunctionRemovePrototype(ObjectToStringHarmony);
+  %SetNativeFlag(ObjectToStringHarmony);
+
   // Set up the non-enumerable functions on the Array prototype object.
   var desc = ToPropertyDescriptor({
     value: ObjectToStringHarmony
   });
   DefineOwnProperty($Object.prototype, "toString", desc, false);
+
+  %ToFastProperties($Object.prototype);
 }
 
 HarmonyToStringExtendObjectPrototype();