Do not poison %FunctionPrototype%'s restricted properties

In ES6, these properties of the intrinsic %FunctionPrototype% are poisoned during
CreateIntrinsics() / AddRestrictedFunctionProperties(). It's unnecessary to poison them
again, and testing whether they are a function or not causes tests to fail.

BUG=v8:3982
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1067223002

Cr-Commit-Position: refs/heads/master@{#324265}

chrome/test/data/extensions/api_test/messaging/externally_connectable/sites/assertions.js

@@ -29,11 +29,15 @@ function clobber(obj, name, qualifiedName) {
   // SafeBuiltins does not support getters yet. See crbug.com/463526.
   // Clobbering Function.call would make it impossible to implement these tests.
   // Clobbering Object.valueOf breaks v8.
+  // Clobbering %FunctionPrototype%.caller and .arguments will break because
+  // these properties are poisoned accessors in ES6.
   if (name == 'constructor' ||
       name == 'toString' ||
       name == '__proto__' ||
       name == 'name' && typeof obj == 'function' ||
       qualifiedName == 'Function.call' ||
+      (obj !== Function && qualifiedName == 'Function.caller') ||
+      (obj !== Function && qualifiedName == 'Function.arguments') ||
       qualifiedName == 'Object.valueOf') {
     return;
   }