[runtime] Set proper initial map for AsyncFunction constructor.

... to make AsyncFunction subclassing work.

Bug: chromium:725537
Change-Id: I7edf4891e14e01567046e7536b3aa93877111448
Reviewed-on: https://chromium-review.googlesource.com/517087
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45544}

src/bootstrapper.cc

@@ -3748,6 +3748,8 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
         container, "AsyncFunction", JS_FUNCTION_TYPE, JSFunction::kSize,
         async_function_prototype, Builtins::kAsyncFunctionConstructor,
         kUseStrictFunctionMap);
+    async_function_constructor->set_prototype_or_initial_map(
+        native_context->async_function_map());
     async_function_constructor->shared()->DontAdaptArguments();
     async_function_constructor->shared()->SetConstructStub(
         *isolate->builtins()->AsyncFunctionConstructor());

test/mjsunit/regress/regress-crbug-725537.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --verify-heap
+
+const AsyncFunction = async function(){}.constructor;
+class MyAsync extends AsyncFunction {}
+var af = new MyAsync();
+gc();