[bootstrapper] set constructor property of %AsyncGeneratorPrototype%

For some reason, the property wasn't already added. Oops!

BUG=v8:7815
R=gsathya@chromium.org, neis@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I71898ca1e84ce930f5d0ed75e44c75071f152904
Reviewed-on: https://chromium-review.googlesource.com/1114327
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54032}

src/bootstrapper.cc

@@ -978,6 +978,10 @@ void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
                         factory()->prototype_string(),
                         async_generator_object_prototype,
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+  JSObject::AddProperty(isolate(), async_generator_object_prototype,
+                        factory()->constructor_string(),
+                        async_generator_function_prototype,
+                        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
   JSObject::AddProperty(isolate(), async_generator_function_prototype,
                         factory()->to_string_tag_symbol(),
                         AsyncGeneratorFunction_string,

test/mjsunit/harmony/async-generators-basic.js

@@ -103,12 +103,35 @@ function AbortUnreachable() {
 // ----------------------------------------------------------------------------
 // Do not install `AsyncGeneratorFunction` constructor on global object
 assertEquals(undefined, this.AsyncGeneratorFunction);
-let AsyncGeneratorFunction = (async function*() {}).constructor;
+
+// ----------------------------------------------------------------------------
+let AsyncGenerator = Object.getPrototypeOf(async function*() {});
+let AsyncGeneratorPrototype = AsyncGenerator.prototype;
+
+// %AsyncGenerator% and %AsyncGeneratorPrototype% are both ordinary objects
+assertEquals("object", typeof AsyncGenerator);
+assertEquals("object", typeof AsyncGeneratorPrototype);
+
+// %AsyncGenerator% <---> %AsyncGeneratorPrototype% circular reference
+assertEquals(AsyncGenerator, AsyncGeneratorPrototype.constructor);
+assertEquals(AsyncGeneratorPrototype, AsyncGenerator.prototype);
+
+let protoDesc = Object.getOwnPropertyDescriptor(AsyncGenerator, 'prototype');
+assertFalse(protoDesc.enumerable);
+assertFalse(protoDesc.writable);
+assertTrue(protoDesc.configurable);
+
+let ctorDesc =
+    Object.getOwnPropertyDescriptor(AsyncGeneratorPrototype, 'constructor');
+assertFalse(ctorDesc.enumerable);
+assertFalse(ctorDesc.writable);
+assertTrue(ctorDesc.configurable);
 
 // ----------------------------------------------------------------------------
 // The AsyncGeneratorFunction Constructor is the %AsyncGeneratorFunction%
 // intrinsic object and is a subclass of Function.
 // (proposal-async-iteration/#sec-asyncgeneratorfunction-constructor)
+let AsyncGeneratorFunction = AsyncGenerator.constructor;
 assertEquals(Object.getPrototypeOf(AsyncGeneratorFunction), Function);
 assertEquals(Object.getPrototypeOf(AsyncGeneratorFunction.prototype),
              Function.prototype);

test/test262/test262.status

@@ -603,9 +603,6 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=7814
   'built-ins/Array/prototype/splice/property-traps-order-with-species': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7815
-  'built-ins/AsyncGeneratorPrototype/constructor': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=7817
   'language/expressions/async-arrow-function/await-as-param-ident-nested-arrow-parameter-position': [FAIL],
   'language/expressions/async-arrow-function/await-as-param-nested-arrow-parameter-position': [FAIL],