js-get-ctor-proto used to always synthesise a per-ctor-id empty dict in
__js_proto_table__, ignoring the :prototype slot that every built-in
constructor dict (Number, String, Array, Boolean, Object, Function)
already carries. So `new Number()` got `{__proto__: {}}` instead of
`{__proto__: Number.prototype}`, breaking every prototype-chain-method
lookup:
(new Number()).toLocaleString // undefined → function
(new Number()).toLocaleString === Number.prototype.toLocaleString
Fix: when the receiver is a dict with a "prototype" key, return that
directly; otherwise fall through to the existing proto-table path.
Declared classes from JS still go through the table because they emit
js-set-ctor-proto! at definition.
Unit 521/522, slice 148/148 unchanged.
Number scoreboard: 53/100 → 58/100 (+5). Sample: S15.7.5_A1_T03..T07
(toLocaleString/toString/toFixed/toExponential prototype identity).
giles
bf09055c4e