Introduce a BuiltinsConstructStub that sets up new.target and does a [[call]] per ES6 9.3.2

src/factory.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/factory.h"
 
 #include "src/allocation-site-scopes.h"
 #include "src/base/bits.h"
 #include "src/bootstrapper.h"
 #include "src/conversions.h"
@@ skipping 1920 matching lines @@
                                           size_t byte_offset,
                                           size_t byte_length) {
   Handle<JSDataView> obj = NewJSDataView();
   SetupArrayBufferView(isolate(), obj, buffer, byte_offset, byte_length);
   return obj;
 }
 
 
 Handle<JSProxy> Factory::NewJSProxy(Handle<JSReceiver> target,
                                     Handle<JSReceiver> handler) {
-  // Allocate map.
-  // TODO(rossberg): Once we optimize proxies, think about a scheme to share
-  // maps. Will probably depend on the identity of the handler object, too.
-  Handle<Map> map = NewMap(JS_PROXY_TYPE, JSProxy::kSize);
-  Map::SetPrototype(map, null_value());
-
   // Allocate the proxy object.
+  Handle<Map> map(isolate()->proxy_function()->initial_map());
+  DCHECK(map->prototype()->IsNull());
   Handle<JSProxy> result = New<JSProxy>(map, NEW_SPACE);
   result->set_target(*target);
   result->set_handler(*handler);
   result->set_hash(*undefined_value(), SKIP_WRITE_BARRIER);
   return result;
 }
 
 
 Handle<JSProxy> Factory::NewJSFunctionProxy(Handle<JSReceiver> target,
                                             Handle<JSReceiver> handler,
@@ skipping 376 matching lines @@
 }
 
 
 Handle<Object> Factory::ToBoolean(bool value) {
   return value ? true_value() : false_value();
 }
 
 
 }  // namespace internal
 }  // namespace v8