[environment] Properly type Function.prototype

Bug: 487347678
Change-Id: Ib8ecc8268ef60847919abe2dc6f081665930fde3
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064299
Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

Author: Liedtke

Sources/Fuzzilli/Environment/JavaScriptEnvironment.swift

@@ -366,6 +366,8 @@ public class JavaScriptEnvironment: ComponentBase {
         registerObjectGroup(.jsPromises)
         registerObjectGroup(.jsRegExps)
         registerObjectGroup(.jsFunctions)
+        registerObjectGroup(.jsFunctionPrototype)
+        registerObjectGroup(.jsFunctionConstructor)
         registerObjectGroup(.jsSymbols)
         registerObjectGroup(.jsMaps)
         registerObjectGroup(.jsMapPrototype)
@@ -1184,7 +1186,7 @@ public extension ILType {
     static let jsArrayConstructor = .functionAndConstructor([.integer] => .jsArray) + .object(ofGroup: "ArrayConstructor", withProperties: ["prototype"], withMethods: ["from", "fromAsync", "of", "isArray"])
 
     /// Type of the JavaScript Function constructor builtin.
-    static let jsFunctionConstructor = ILType.constructor([.string] => .jsFunction(Signature.forUnknownFunction))
+    static let jsFunctionConstructor = ILType.constructor([.string] => .jsFunction(Signature.forUnknownFunction)) + .object(ofGroup: "FunctionConstructor", withProperties: ["prototype"])
 
     /// Type of the JavaScript String constructor builtin.
     static let jsStringConstructor = ILType.functionAndConstructor([.jsAnything] => .jsString) + .object(ofGroup: "StringConstructor", withProperties: ["prototype"], withMethods: ["fromCharCode", "fromCodePoint", "raw"])
@@ -1605,6 +1607,19 @@ public extension ObjectGroup {
         ]
     )
 
+    static let jsFunctionPrototype = createPrototypeObjectGroup(jsFunctions,
+        constructor: .jsFunctionConstructor)
+
+    static let jsFunctionConstructor = ObjectGroup(
+        name: "FunctionConstructor",
+        constructorPath: "Function",
+        instanceType: .jsFunctionConstructor,
+        properties: [
+            "prototype"   : jsFunctionPrototype.instanceType,
+        ],
+        methods: [:]
+    )
+
     /// ObjectGroup modelling JavaScript Symbols
     static let jsSymbols = ObjectGroup(
         name: "Symbol",