Introduce a BuiltinsConstructStub that sets up new.target and does a [[call]] per ES6 9.3.2

src/runtime/runtime-proxy.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/factory.h"
 #include "src/objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
 RUNTIME_FUNCTION(Runtime_CreateJSProxy) {
   HandleScope scope(isolate);
-  DCHECK(args.length() == 3);
-  CONVERT_ARG_HANDLE_CHECKED(JSProxy, instance, 0);
-  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, target, 1);
-  CONVERT_ARG_HANDLE_CHECKED(Object, handler, 2);
+  DCHECK(args.length() == 2);
+  CONVERT_ARG_HANDLE_CHECKED(Object, target, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, handler, 1);
   if (!target->IsSpecObject()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kProxyTargetNonObject));
   }
   if (target->IsJSProxy() && !JSProxy::cast(*target)->has_handler()) {
     // TODO(cbruni): Use better error message.
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kProxyTargetNonObject));
   }
   if (!handler->IsSpecObject()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kProxyHandlerNonObject));
   }
   if (handler->IsJSProxy() && !JSProxy::cast(*handler)->has_handler()) {
     // TODO(cbruni): Use better error message.
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kProxyHandlerNonObject));
   }
-  instance->set_target(*target);
-  instance->set_handler(*handler);
-  instance->set_hash(isolate->heap()->undefined_value(), SKIP_WRITE_BARRIER);
-  return *instance;
+  return *isolate->factory()->NewJSProxy(Handle<JSReceiver>::cast(target),
+                                         Handle<JSReceiver>::cast(handler));
 }
 
 
 RUNTIME_FUNCTION(Runtime_CreateJSFunctionProxy) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 5);
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, target, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, handler, 1);
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, call_trap, 2);
   RUNTIME_ASSERT(call_trap->IsJSFunction() || call_trap->IsJSFunctionProxy());
@@ skipping 39 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_GetConstructTrap) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 1);
   CONVERT_ARG_CHECKED(JSFunctionProxy, proxy, 0);
   return proxy->construct_trap();
 }
 
 }  // namespace internal
 }  // namespace v8