[runtime] Setup Constructor for proxy_map

Bug: chromium:868473
Change-Id: I6a2f9be15cdc05cfa793650436c7ec3dd583bef4
Reviewed-on: https://chromium-review.googlesource.com/1158833Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Chandan Reddy <chandanreddy@google.com>
Cr-Commit-Position: refs/heads/master@{#54857}

src/bootstrapper.cc

@@ -3448,6 +3448,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         name, proxy_function_map, Builtins::kProxyConstructor);
     Handle<JSFunction> proxy_function = factory->NewFunction(args);
 
+    isolate_->proxy_map()->SetConstructor(*proxy_function);
+
     proxy_function->shared()->set_internal_formal_parameter_count(2);
     proxy_function->shared()->set_length(2);
 

src/objects-debug.cc

@@ -1426,6 +1426,7 @@ void JSRegExpStringIterator::JSRegExpStringIteratorVerify(Isolate* isolate) {
 
 void JSProxy::JSProxyVerify(Isolate* isolate) {
   CHECK(IsJSProxy());
+  CHECK(map()->GetConstructor()->IsJSFunction());
   VerifyPointer(isolate, target());
   VerifyPointer(isolate, handler());
   if (!IsRevoked()) {

test/mjsunit/regress/regress-5085.js

@@ -64,3 +64,11 @@ Proxy.__proto__ = {
   a: 1
 };
 assertEquals(Proxy.prototype, {b: 2});
+
+(function testProxyCreationContext() {
+  let realm = Realm.create();
+  let p1 = new Proxy({}, {});
+  let p2 = Realm.eval(realm, "new Proxy({}, {})");
+  assertEquals(0, Realm.owner(p1));
+  assertEquals(1, Realm.owner(p2));
+})();