Bug 1749477 - change array groupby to create a null prototype object; r=evilpie

Differential Revision: https://phabricator.services.mozilla.com/D137280

js/src/builtin/Array.js

@@ -358,7 +358,7 @@ function ArrayGroupBy(callbackfn/*, thisArg*/) {
     }
 
     /* Step 7. Let obj be ! OrdinaryObjectCreate(null). */
-    var object = {};
+    var object = std_Object_create(null);
 
     /* Step 8. For each Record { [[Key]], [[Elements]] } g of groups, do
      *  a. Let elements be ! CreateArrayFromList(g.[[Elements]]).

js/src/tests/non262/Array/groupBy.js

@@ -20,6 +20,7 @@ function isNeg(x) {
   const groupedArray = a1.groupBy(x => isNeg(x) ? 'neg' : 'pos');
   const mappedArray = a1.groupByToMap(x => isNeg(x) ? 'neg' : 'pos');
 
+  assertEq(Object.getPrototypeOf(groupedArray), null)
   assertDeepEq(groupedArray, expectedObj);
   assertDeepEq(mappedArray.get("neg"), expectedObj["neg"]);
   assertDeepEq(mappedArray.get("pos"), expectedObj["pos"]);