[Backport] CVE-2023-3420: Type Confusion in V8 (1/2)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/v8/v8/+/4618153:
Set instance prototypes directly on maps

Bug: chromium:1452137
Change-Id: If1de44950711c99da4ace2e988f188421e849330
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4618153
Commit-Queue: Toon Verwaest <[email protected]>
Reviewed-by: Igor Sheludko <[email protected]>
Auto-Submit: Toon Verwaest <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/heads/main@{#88326}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/489357
Reviewed-by: Allan Sandfeld Jensen <[email protected]>

chromium/v8/src/objects/js-function.cc

@@ -676,6 +676,10 @@ void SetInstancePrototype(Isolate* isolate, Handle<JSFunction> function,
       // At that point, a new initial map is created and the prototype is put
       // into the initial map where it belongs.
       function->set_prototype_or_initial_map(*value, kReleaseStore);
+      if (value->IsJSObjectThatCanBeTrackedAsPrototype()) {
+        // Optimize as prototype to detach it from its transition tree.
+        JSObject::OptimizeAsPrototype(Handle<JSObject>::cast(value));
+      }
     } else {
       Handle<Map> new_map =
           Map::Copy(isolate, initial_map, "SetInstancePrototype");
@@ -801,8 +805,10 @@ void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
   Handle<HeapObject> prototype;
   if (function->has_instance_prototype()) {
     prototype = handle(function->instance_prototype(), isolate);
+    map->set_prototype(*prototype);
   } else {
     prototype = isolate->factory()->NewFunctionPrototype(function);
+    Map::SetPrototype(isolate, map, prototype);
   }
   DCHECK(map->has_fast_object_elements());