[es6] Fix Function and GeneratorFunction built-ins subclassing.

src/runtime/runtime-object.cc

Index: src/runtime/runtime-object.cc
diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc
index d238681ae0de56b3811c71f67192390c5dae5cdd..0e6b1ecf16a7e538c46df520be7b023c525f0fa1 100644
--- a/src/runtime/runtime-object.cc
+++ b/src/runtime/runtime-object.cc
@@ -997,24 +997,16 @@ static Object* Runtime_NewObjectHelper(Isolate* isolate,
   Compiler::Compile(function, CLEAR_EXCEPTION);
 
   JSFunction::EnsureHasInitialMap(function);
-  Handle<Map> initial_map =
-      JSFunction::EnsureDerivedHasInitialMap(original_function, function);
-
-  if (initial_map->instance_type() == JS_FUNCTION_TYPE) {
+  if (function->initial_map()->instance_type() == JS_FUNCTION_TYPE) {
     // The 'Function' function ignores the receiver object when
     // called using 'new' and creates a new JSFunction object that
-    // is returned.  The receiver object is only used for error
-    // reporting if an error occurs when constructing the new
-    // JSFunction. Factory::NewJSObject() should not be used to
-    // allocate JSFunctions since it does not properly initialize
-    // the shared part of the function. Since the receiver is
-    // ignored anyway, we use the global object as the receiver
-    // instead of a new JSFunction object. This way, errors are
-    // reported the same way whether or not 'Function' is called
-    // using 'new'.
-    return isolate->global_proxy();
+    // is returned.
+    return isolate->heap()->undefined_value();
   }
 
+  Handle<Map> initial_map =
+      JSFunction::EnsureDerivedHasInitialMap(original_function, function);
+
   Handle<JSObject> result =
       isolate->factory()->NewJSObjectFromMap(initial_map, NOT_TENURED, site);