[wasm] Fix subclassing for WebAssembly.* types.

R=rossberg@chromium.org

Bug: chromium:772636
Change-Id: I885f8657eb755953be17d7bf32aef2629092b9c2
Reviewed-on: https://chromium-review.googlesource.com/733086Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48830}

src/objects.cc

@@ -12829,6 +12829,10 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case JS_VALUE_TYPE:
     case JS_WEAK_MAP_TYPE:
     case JS_WEAK_SET_TYPE:
+    case WASM_INSTANCE_TYPE:
+    case WASM_MEMORY_TYPE:
+    case WASM_MODULE_TYPE:
+    case WASM_TABLE_TYPE:
       return true;
 
     case BIGINT_TYPE:

test/mjsunit/wasm/js-api.js

@@ -889,3 +889,17 @@ assertInstantiateSuccess(importingModuleBinary, {'': {f: () => {}}});
 assertInstantiateSuccess(importingModuleBinary.buffer, {'': {f: () => {}}});
 assertInstantiateSuccess(
     memoryImportingModuleBinary, {'': {'my_memory': scratch_memory}});
+
+(function TestSubclassing() {
+  class M extends WebAssembly.Module { }
+  assertThrows(() => new M());
+
+  class I extends WebAssembly.Instance { }
+  assertThrows(() => new I());
+
+  class T extends WebAssembly.Table { }
+  assertThrows(() => new T());
+
+  class Y extends WebAssembly.Memory { }
+  assertThrows(() => new Y());
+})();