Bug 1631267 part 2 - Create MapIteratorProto, SetIteratorProto, FinalizationIteratorProto as singletons. r=jwalden

While working on the previous patch I noticed some builtin prototypes weren't tenured.

Use createBlankPrototypeInheriting for consistency with similar code elsewhere.

Depends on D73221

Differential Revision: https://phabricator.services.mozilla.com/D73222

js/src/builtin/FinalizationRegistryObject.cpp

@@ -852,7 +852,8 @@ bool GlobalObject::initFinalizationIteratorProto(JSContext* cx,
   if (!base) {
     return false;
   }
-  RootedPlainObject proto(cx, NewObjectWithGivenProto<PlainObject>(cx, base));
+  RootedPlainObject proto(
+      cx, GlobalObject::createBlankPrototypeInheriting<PlainObject>(cx, base));
   if (!proto) {
     return false;
   }

js/src/builtin/MapObject.cpp

@@ -177,7 +177,8 @@ bool GlobalObject::initMapIteratorProto(JSContext* cx,
   if (!base) {
     return false;
   }
-  RootedPlainObject proto(cx, NewObjectWithGivenProto<PlainObject>(cx, base));
+  RootedPlainObject proto(
+      cx, GlobalObject::createBlankPrototypeInheriting<PlainObject>(cx, base));
   if (!proto) {
     return false;
   }
@@ -959,7 +960,8 @@ bool GlobalObject::initSetIteratorProto(JSContext* cx,
   if (!base) {
     return false;
   }
-  RootedPlainObject proto(cx, NewObjectWithGivenProto<PlainObject>(cx, base));
+  RootedPlainObject proto(
+      cx, GlobalObject::createBlankPrototypeInheriting<PlainObject>(cx, base));
   if (!proto) {
     return false;
   }

js/src/vm/GlobalObject.h

@@ -298,6 +298,12 @@ class GlobalObject : public NativeObject {
                                                       const JSClass* clasp,
                                                       HandleObject proto);
 
+  template <typename T>
+  static T* createBlankPrototypeInheriting(JSContext* cx, HandleObject proto) {
+    NativeObject* res = createBlankPrototypeInheriting(cx, &T::class_, proto);
+    return res ? &res->template as<T>() : nullptr;
+  }
+
   template <typename T>
   static T* createBlankPrototype(JSContext* cx, Handle<GlobalObject*> global) {
     NativeObject* res = createBlankPrototype(cx, global, &T::class_);