[runtime] Set constructor field on preallocated maps.

The preallocated JSAccessorPropertyDescriptor, JSDataPropertyDescriptor and
JSIteratorResult had the constructor field unset, which in turn causes
GetCreationContext() to fail for those instances.

R=verwaest@chromium.org
BUG=v8:4738
LOG=n

Review URL: https://codereview.chromium.org/1676823002

Cr-Commit-Position: refs/heads/master@{#33802}

src/bootstrapper.cc

@@ -1591,6 +1591,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
       map->AppendDescriptor(&d);
     }
 
+    map->SetConstructor(native_context()->object_function());
     map->SetInObjectProperties(2);
     native_context()->set_iterator_result_map(*map);
   }
@@ -2789,6 +2790,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
     }
 
     Map::SetPrototype(map, isolate()->initial_object_prototype());
+    map->SetConstructor(native_context()->object_function());
     map->SetInObjectProperties(4);
     map->set_unused_property_fields(0);
 
@@ -2831,6 +2833,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
     }
 
     Map::SetPrototype(map, isolate()->initial_object_prototype());
+    map->SetConstructor(native_context()->object_function());
     map->SetInObjectProperties(4);
     map->set_unused_property_fields(0);