[WeakRefs] Install native context slot index on constructors

This will be used when the [[NewTarget]] is from another realm and
it's prototype is not an object.

Bug: v8:8179
Change-Id: Ic69db3cd95753c77ef6f1e677e71e1e20da0a6c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714864Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62869}

src/init/bootstrapper.cc

@@ -4293,6 +4293,9 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
         isolate(), finalization_group_name, JS_FINALIZATION_GROUP_TYPE,
         JSFinalizationGroup::kSize, 0, finalization_group_prototype,
         Builtins::kFinalizationGroupConstructor);
+    InstallWithIntrinsicDefaultProto(
+        isolate(), finalization_group_fun,
+        Context::JS_FINALIZATION_GROUP_FUNCTION_INDEX);
 
     finalization_group_fun->shared().DontAdaptArguments();
     finalization_group_fun->shared().set_length(1);
@@ -4339,6 +4342,8 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
     Handle<JSFunction> weak_ref_fun = CreateFunction(
         isolate(), weak_ref_name, JS_WEAK_REF_TYPE, JSWeakRef::kSize, 0,
         weak_ref_prototype, Builtins::kWeakRefConstructor);
+    InstallWithIntrinsicDefaultProto(isolate(), weak_ref_fun,
+                                     Context::JS_WEAK_REF_FUNCTION_INDEX);
 
     weak_ref_fun->shared().DontAdaptArguments();
     weak_ref_fun->shared().set_length(1);

src/objects/contexts.h

@@ -181,6 +181,9 @@ enum ContextLookupFlags {
     js_finalization_group_cleanup_iterator_map)                                \
   V(JS_WEAK_MAP_FUN_INDEX, JSFunction, js_weak_map_fun)                        \
   V(JS_WEAK_SET_FUN_INDEX, JSFunction, js_weak_set_fun)                        \
+  V(JS_WEAK_REF_FUNCTION_INDEX, JSFunction, js_weak_ref_fun)                   \
+  V(JS_FINALIZATION_GROUP_FUNCTION_INDEX, JSFunction,                          \
+    js_finalization_group_fun)                                                 \
   V(MAP_CACHE_INDEX, Object, map_cache)                                        \
   V(MAP_KEY_ITERATOR_MAP_INDEX, Map, map_key_iterator_map)                     \
   V(MAP_KEY_VALUE_ITERATOR_MAP_INDEX, Map, map_key_value_iterator_map)         \

test/test262/test262.status

@@ -536,8 +536,6 @@
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=8179
   'built-ins/FinalizationGroup/gc-has-one-chance-to-call-cleanupCallback': [FAIL],
-  'built-ins/FinalizationGroup/newtarget-prototype-is-not-object': [FAIL],
-  'built-ins/FinalizationGroup/proto-from-ctor-realm': [FAIL],
   'built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself': [FAIL],
   'built-ins/FinalizationGroup/prototype/register/unregisterToken-not-object-or-undefined-throws': [FAIL],
   'built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-job-not-active-throws': [FAIL],
@@ -560,8 +558,6 @@
   'built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined-with-gc': [FAIL],
   'built-ins/FinalizationGroup/prototype/register/holdings-same-as-target': [FAIL],
   'built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target': [FAIL],
-  'built-ins/WeakRef/newtarget-prototype-is-not-object': [FAIL],
-  'built-ins/WeakRef/proto-from-ctor-realm': [FAIL],
   'built-ins/WeakRef/prototype/deref/gc-cleanup-not-prevented-with-wr-deref': [FAIL],
 
   ######################## NEEDS INVESTIGATION ###########################