[init] Install intrinsic default proto on async function constructor

The intrinsic default proto was not installed on async
function constructor, so the proto for those unable to
get a proper receiver fallbacks to the realms'
%Object.prototype%.

Bug: v8:9818
Change-Id: I08b9459d60da72dc894b983973e0a36019be9141
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3043691Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75866}

src/init/bootstrapper.cc

@@ -4302,6 +4302,10 @@ void Genesis::InitializeIteratorFunctions() {
         native_context->async_function_map(), kReleaseStore);
     async_function_constructor->shared().DontAdaptArguments();
     async_function_constructor->shared().set_length(1);
+    InstallWithIntrinsicDefaultProto(
+        isolate, async_function_constructor,
+        Context::ASYNC_FUNCTION_FUNCTION_INDEX);
+
     native_context->set_async_function_constructor(*async_function_constructor);
     JSObject::ForceSetPrototype(isolate, async_function_constructor,
                                 isolate->function_function());

test/test262/test262.status

@@ -504,9 +504,6 @@
   # http://crbug/v8/10447
   'intl402/Intl/getCanonicalLocales/unicode-ext-canonicalize-yes-to-true': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=9818
-  'built-ins/AsyncFunction/proto-from-ctor-realm': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=10381
   'built-ins/Array/prototype/concat/arg-length-near-integer-limit': [FAIL],