Introduce a BuiltinsConstructStub that sets up new.target and does a [[call]] per ES6 9.3.2

src/objects-body-descriptors-inl.h

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_OBJECTS_BODY_DESCRIPTORS_INL_H_
 #define V8_OBJECTS_BODY_DESCRIPTORS_INL_H_
 
 #include "src/objects-body-descriptors.h"
 
 namespace v8 {
@@ skipping 451 matching lines @@
     UNREACHABLE();
     return ReturnType();
   }
 
   switch (type) {
     case FIXED_ARRAY_TYPE:
       return Op::template apply<FixedArray::BodyDescriptor>(p1, p2, p3);
     case FIXED_DOUBLE_ARRAY_TYPE:
       return ReturnType();
     case JS_OBJECT_TYPE:
+    case JS_PROMISE_TYPE:
     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
     case JS_GENERATOR_OBJECT_TYPE:
     case JS_MODULE_TYPE:
     case JS_VALUE_TYPE:
     case JS_DATE_TYPE:
     case JS_ARRAY_TYPE:
     case JS_TYPED_ARRAY_TYPE:
     case JS_DATA_VIEW_TYPE:
     case JS_SET_TYPE:
     case JS_MAP_TYPE:
@@ skipping 92 matching lines @@
 
 template <typename ObjectVisitor>
 void HeapObject::IterateBodyFast(InstanceType type, int object_size,
                                  ObjectVisitor* v) {
   BodyDescriptorApply<CallIterateBody, void>(type, this, object_size, v);
 }
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_OBJECTS_BODY_DESCRIPTORS_INL_H_