In PathTypeHandler.cpp line 1470 has the call below which eventually ends up modifying the hasNoEnumerableProperties flag of the newPrototype object due to an "internal property" being added to the newPrototype object.
newPrototype->SetInternalProperty(Js::InternalPropertyIds::TypeOfPrototypeObjectDictionary, (Var)oldTypeToPromotedTypeMap, PropertyOperationFlags::PropertyOperation_Force, nullptr);
If the newPrototype object has hasNoEnumerableProperties as true, then this will call down through SimpleDictionaryTypeHandler.cpp line 1325 which adds the internal property with the default set of attribute flags:
return this->AddProperty(instance, propertyRecord, value, PropertyDynamicTypeDefaults, info, flags, SideEffects_Any);
This will then reach line 2609 which checks and sets hasNoEnumerableProperties as false:
if (attributes & PropertyEnumerable)
{
instance->SetHasNoEnumerableProperties(false);
}