[SAB] Fix {newtarget-prototype-is-not-object,proto-from-ctor-realm} tests

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/api-natives.h"
 #include "src/base/ieee754.h"
 #include "src/code-stubs.h"
@@ skipping 3883 matching lines @@
 
   Handle<JSGlobalObject> global(native_context()->global_object());
   Isolate* isolate = global->GetIsolate();
   Factory* factory = isolate->factory();
 
   Handle<JSFunction> shared_array_buffer_fun =
       InstallArrayBuffer(global, "SharedArrayBuffer",
                          Builtins::kSharedArrayBufferPrototypeGetByteLength,
                          BuiltinFunctionId::kSharedArrayBufferByteLength,
                          Builtins::kSharedArrayBufferPrototypeSlice);
-  native_context()->set_shared_array_buffer_fun(*shared_array_buffer_fun);
+  InstallWithIntrinsicDefaultProto(isolate, shared_array_buffer_fun,
+                                   Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
+  InstallSpeciesGetter(shared_array_buffer_fun);
 
   Handle<String> name = factory->InternalizeUtf8String("Atomics");
   Handle<JSFunction> cons = factory->NewFunction(name);
   JSFunction::SetInstancePrototype(
       cons,
       Handle<Object>(native_context()->initial_object_prototype(), isolate));
   Handle<JSObject> atomics_object = factory->NewJSObject(cons, TENURED);
   DCHECK(atomics_object->IsJSObject());
   JSObject::AddProperty(global, name, atomics_object, DONT_ENUM);
   JSObject::AddProperty(atomics_object, factory->to_string_tag_symbol(), name,
@@ skipping 1375 matching lines @@
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   DCHECK(!IsActive());
 }
 
 }  // namespace internal
 }  // namespace v8