This is virtual due to problems in JSFunction putting the prototype property, but we can fix this problem a different way, just setting the checkReadOnly flag to false in the put.
Fixed in r95205