From 018c10c10c871575462fdc8c778ca17a2320d377 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Fri, 1 May 2020 03:15:45 +0000
Subject: [PATCH] Bug 1631267 part 2 - Create MapIteratorProto,
 SetIteratorProto, FinalizationIteratorProto as singletons. r=jwalden

While working on the previous patch I noticed some builtin prototypes weren't tenured.

Use createBlankPrototypeInheriting for consistency with similar code elsewhere.

Depends on D73221

Differential Revision: https://phabricator.services.mozilla.com/D73222
---
 js/src/builtin/FinalizationRegistryObject.cpp | 3 ++-
 js/src/builtin/MapObject.cpp                  | 6 ++++--
 js/src/vm/GlobalObject.h                      | 6 ++++++
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/js/src/builtin/FinalizationRegistryObject.cpp b/js/src/builtin/FinalizationRegistryObject.cpp
index 17a326f3ff75..04e119f7c3f5 100644
--- a/js/src/builtin/FinalizationRegistryObject.cpp
+++ b/js/src/builtin/FinalizationRegistryObject.cpp
@@ -852,7 +852,8 @@ bool GlobalObject::initFinalizationIteratorProto(JSContext* cx,
   if (!base) {
     return false;
   }
-  RootedPlainObject proto(cx, NewObjectWithGivenProto<PlainObject>(cx, base));
+  RootedPlainObject proto(
+      cx, GlobalObject::createBlankPrototypeInheriting<PlainObject>(cx, base));
   if (!proto) {
     return false;
   }
diff --git a/js/src/builtin/MapObject.cpp b/js/src/builtin/MapObject.cpp
index c8f4cb91ea46..74065a743f2b 100644
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@@ -177,7 +177,8 @@ bool GlobalObject::initMapIteratorProto(JSContext* cx,
   if (!base) {
     return false;
   }
-  RootedPlainObject proto(cx, NewObjectWithGivenProto<PlainObject>(cx, base));
+  RootedPlainObject proto(
+      cx, GlobalObject::createBlankPrototypeInheriting<PlainObject>(cx, base));
   if (!proto) {
     return false;
   }
@@ -959,7 +960,8 @@ bool GlobalObject::initSetIteratorProto(JSContext* cx,
   if (!base) {
     return false;
   }
-  RootedPlainObject proto(cx, NewObjectWithGivenProto<PlainObject>(cx, base));
+  RootedPlainObject proto(
+      cx, GlobalObject::createBlankPrototypeInheriting<PlainObject>(cx, base));
   if (!proto) {
     return false;
   }
diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h
index fc289aa4e668..35a0b6872cce 100644
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -298,6 +298,12 @@ class GlobalObject : public NativeObject {
                                                       const JSClass* clasp,
                                                       HandleObject proto);
 
+  template <typename T>
+  static T* createBlankPrototypeInheriting(JSContext* cx, HandleObject proto) {
+    NativeObject* res = createBlankPrototypeInheriting(cx, &T::class_, proto);
+    return res ? &res->template as<T>() : nullptr;
+  }
+
   template <typename T>
   static T* createBlankPrototype(JSContext* cx, Handle<GlobalObject*> global) {
     NativeObject* res = createBlankPrototype(cx, global, &T::class_);