[WeakRefs] Allow WeakRef and FinalizationGroups to be subclassable

Bug: v8:9433, v8:8179
Change-Id: I10a643cac348a5a76b137427e5e0565db81e3dbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714649Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62868}

src/objects/js-objects.cc

@@ -5195,6 +5195,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case JS_MESSAGE_OBJECT_TYPE:
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
+    case JS_FINALIZATION_GROUP_TYPE:
     case JS_ARGUMENTS_TYPE:
     case JS_PROMISE_TYPE:
     case JS_REGEXP_TYPE:
@@ -5203,6 +5204,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case JS_TYPED_ARRAY_TYPE:
     case JS_PRIMITIVE_WRAPPER_TYPE:
     case JS_WEAK_MAP_TYPE:
+    case JS_WEAK_REF_TYPE:
     case JS_WEAK_SET_TYPE:
     case WASM_GLOBAL_TYPE:
     case WASM_INSTANCE_TYPE:

test/test262/test262.status

@@ -564,10 +564,6 @@
   'built-ins/WeakRef/proto-from-ctor-realm': [FAIL],
   'built-ins/WeakRef/prototype/deref/gc-cleanup-not-prevented-with-wr-deref': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=9433
-  'built-ins/FinalizationGroup/prototype-from-newtarget-custom': [SKIP],
-  'built-ins/WeakRef/prototype-from-newtarget-custom': [SKIP],
-
   ######################## NEEDS INVESTIGATION ###########################
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=7833