Introduce a BuiltinsConstructStub that sets up new.target and does a [[call]] per ES6 9.3.2

src/js/v8natives.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 %CheckIsBootstrapping();
 
 // ----------------------------------------------------------------------------
 // Imports
@@ skipping 1356 matching lines @@
 ]);
 
 
 // ----------------------------------------------------------------------------
 // Number
 
 function NumberConstructor(x) {
   // TODO(bmeurer): Move this to toplevel.
   "use strict";
   var value = %_ArgumentsLength() == 0 ? 0 : TO_NUMBER(x);
-  if (%_IsConstructCall()) {
-    %_SetValueOf(this, value);
-  } else {
-    return value;
-  }
+  if (IS_UNDEFINED(new.target)) return value;
+
+  var result = %NewObject(GlobalNumber, new.target);
+  %_SetValueOf(result, value);
+  return result;
 }
 
 
 // ECMA-262 section 15.7.4.2.
 function NumberToStringJS(radix) {
   // NOTE: Both Number objects and values can enter here as
   // 'this'. This is not as dictated by ECMA-262.
   var number = this;
   if (!IS_NUMBER(this)) {
     if (!IS_NUMBER_WRAPPER(this)) {
@@ skipping 402 matching lines @@
 
 %InstallToContext([
   "global_eval_fun", GlobalEval,
   "object_value_of", ObjectValueOf,
   "object_to_string", ObjectToString,
   "object_get_own_property_descriptor", ObjectGetOwnPropertyDescriptor,
   "to_complete_property_descriptor", ToCompletePropertyDescriptor,
 ]);
 
 })