Revert of [es6] Fix Function and GeneratorFunction built-ins subclassing.

src/runtime/runtime-object.cc

Index: src/runtime/runtime-object.cc
diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc
index 0e6b1ecf16a7e538c46df520be7b023c525f0fa1..d238681ae0de56b3811c71f67192390c5dae5cdd 100644
--- a/src/runtime/runtime-object.cc
+++ b/src/runtime/runtime-object.cc
@@ -997,15 +997,23 @@
   Compiler::Compile(function, CLEAR_EXCEPTION);
 
   JSFunction::EnsureHasInitialMap(function);
-  if (function->initial_map()->instance_type() == JS_FUNCTION_TYPE) {
+  Handle<Map> initial_map =
+      JSFunction::EnsureDerivedHasInitialMap(original_function, function);
+
+  if (initial_map->instance_type() == JS_FUNCTION_TYPE) {
     // The 'Function' function ignores the receiver object when
     // called using 'new' and creates a new JSFunction object that
-    // is returned.
-    return isolate->heap()->undefined_value();
-  }
-
-  Handle<Map> initial_map =
-      JSFunction::EnsureDerivedHasInitialMap(original_function, function);
+    // is returned.  The receiver object is only used for error
+    // reporting if an error occurs when constructing the new
+    // JSFunction. Factory::NewJSObject() should not be used to
+    // allocate JSFunctions since it does not properly initialize
+    // the shared part of the function. Since the receiver is
+    // ignored anyway, we use the global object as the receiver
+    // instead of a new JSFunction object. This way, errors are
+    // reported the same way whether or not 'Function' is called
+    // using 'new'.
+    return isolate->global_proxy();
+  }
 
   Handle<JSObject> result =
       isolate->factory()->NewJSObjectFromMap(initial_map, NOT_TENURED, site);