[es6] Fix Function and GeneratorFunction built-ins subclassing.

src/runtime/runtime-object.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/bootstrapper.h"
 #include "src/debug/debug.h"
 #include "src/isolate-inl.h"
@@ skipping 979 matching lines @@
 
   Debug* debug = isolate->debug();
   // Handle stepping into constructors if step into is active.
   if (debug->StepInActive()) debug->HandleStepIn(function, true);
 
   // The function should be compiled for the optimization hints to be
   // available.
   Compiler::Compile(function, CLEAR_EXCEPTION);
 
   JSFunction::EnsureHasInitialMap(function);
+  if (function->initial_map()->instance_type() == JS_FUNCTION_TYPE) {
+    // The 'Function' function ignores the receiver object when
+    // called using 'new' and creates a new JSFunction object that
+    // is returned.
+    return isolate->heap()->undefined_value();
+  }
+
   Handle<Map> initial_map =
       JSFunction::EnsureDerivedHasInitialMap(original_function, function);
 
-  if (initial_map->instance_type() == JS_FUNCTION_TYPE) {
-    // The 'Function' function ignores the receiver object when
-    // called using 'new' and creates a new JSFunction object that
-    // is returned.  The receiver object is only used for error
-    // reporting if an error occurs when constructing the new
-    // JSFunction. Factory::NewJSObject() should not be used to
-    // allocate JSFunctions since it does not properly initialize
-    // the shared part of the function. Since the receiver is
-    // ignored anyway, we use the global object as the receiver
-    // instead of a new JSFunction object. This way, errors are
-    // reported the same way whether or not 'Function' is called
-    // using 'new'.
-    return isolate->global_proxy();
-  }
-
   Handle<JSObject> result =
       isolate->factory()->NewJSObjectFromMap(initial_map, NOT_TENURED, site);
 
   isolate->counters()->constructed_objects()->Increment();
   isolate->counters()->constructed_objects_runtime()->Increment();
 
   return *result;
 }
 
 
@@ skipping 531 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_ObjectDefineProperties) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 2);
   CONVERT_ARG_HANDLE_CHECKED(Object, o, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, properties, 1);
   return JSReceiver::DefineProperties(isolate, o, properties);
 }
 }  // namespace internal
 }  // namespace v8