Fix initial prototype of WeakMap function.

The bootstrapper accidentally overwrote the constructor property of the Object
prototype because it used initial_object_prototype() as prototype for WeakMap.
Unfortunately this is not possible for experimental natives because they are
installed after the snapshot initialization finished.

R=erik.corry@gmail.com
TEST=mjsunit/mirror-object,mjsunit/harmony/weakmaps

Review URL: http://codereview.chromium.org/7624041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9067 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/bootstrapper.cc

@@ -1160,7 +1160,7 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> inner_global,
 
 
   {
-    // Setup the call-as-function delegate.
+    // Set up the call-as-function delegate.
     Handle<Code> code =
         Handle<Code>(isolate->builtins()->builtin(
             Builtins::kHandleApiCallAsFunction));
@@ -1172,7 +1172,7 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> inner_global,
   }
 
   {
-    // Setup the call-as-constructor delegate.
+    // Set up the call-as-constructor delegate.
     Handle<Code> code =
         Handle<Code>(isolate->builtins()->builtin(
             Builtins::kHandleApiCallAsConstructor));
@@ -1192,15 +1192,15 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> inner_global,
 
 
 void Genesis::InitializeExperimentalGlobal() {
-  Isolate* isolate = this->isolate();
   Handle<JSObject> global = Handle<JSObject>(global_context()->global());
 
   // TODO(mstarzinger): Move this into Genesis::InitializeGlobal once we no
   // longer need to live behind a flag, so WeakMap gets added to the snapshot.
   if (FLAG_harmony_weakmaps) {  // -- W e a k M a p
+    Handle<JSObject> prototype =
+        factory()->NewJSObject(isolate()->object_function(), TENURED);
     InstallFunction(global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize,
-                    isolate->initial_object_prototype(),
-                    Builtins::kIllegal, true);
+                    prototype, Builtins::kIllegal, true);
   }
 }
 

src/weakmap.js

@@ -81,13 +81,16 @@ function WeakMapDelete(key) {
 // -------------------------------------------------------------------
 
 function SetupWeakMap() {
-  // Setup the WeakMap constructor function.
+  // Set up the WeakMap constructor function.
   %SetCode($WeakMap, WeakMapConstructor);
 
-  // Setup the WeakMap prototype object.
+  // Set up the WeakMap prototype object.
   %FunctionSetPrototype($WeakMap, new $WeakMap());
 
-  // Setup the non-enumerable functions on the WeakMap prototype object.
+  // Set up the constructor property on the WeakMap prototype object.
+  %SetProperty($WeakMap.prototype, "constructor", $WeakMap, DONT_ENUM);
+
+  // Set up the non-enumerable functions on the WeakMap prototype object.
   InstallFunctionsOnHiddenPrototype($WeakMap.prototype, DONT_ENUM, $Array(
     "get", WeakMapGet,
     "set", WeakMapSet,

test/mjsunit/harmony/weakmaps.js

@@ -137,6 +137,7 @@ assertTrue(WeakMap.prototype.set instanceof Function)
 assertTrue(WeakMap.prototype.get instanceof Function)
 assertTrue(WeakMap.prototype.has instanceof Function)
 assertTrue(WeakMap.prototype.delete instanceof Function)
+assertTrue(WeakMap.prototype.constructor === WeakMap)
 
 
 // Regression test for issue 1617: The prototype of the WeakMap constructor