Introduce a BuiltinsConstructStub that sets up new.target and does a [[call]] per ES6 9.3.2

src/runtime/runtime.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_RUNTIME_RUNTIME_H_
 #define V8_RUNTIME_RUNTIME_H_
 
 #include "src/allocation.h"
 #include "src/objects.h"
 #include "src/unicode.h"
@@ skipping 525 matching lines @@
   F(ShiftRightLogical, 2, 1)            \
   F(ShiftRightLogical_Strong, 2, 1)     \
   F(BitwiseAnd, 2, 1)                   \
   F(BitwiseAnd_Strong, 2, 1)            \
   F(BitwiseOr, 2, 1)                    \
   F(BitwiseOr_Strong, 2, 1)             \
   F(BitwiseXor, 2, 1)                   \
   F(BitwiseXor_Strong, 2, 1)
 
 #define FOR_EACH_INTRINSIC_PROXY(F) \
-  F(CreateJSProxy, 3, 1)            \
+  F(CreateJSProxy, 2, 1)            \
   F(CreateJSFunctionProxy, 5, 1)    \
   F(IsJSProxy, 1, 1)                \
   F(IsJSFunctionProxy, 1, 1)        \
   F(GetHandler, 1, 1)               \
   F(GetCallTrap, 1, 1)              \
   F(GetConstructTrap, 1, 1)
 
 
 #define FOR_EACH_INTRINSIC_REGEXP(F)           \
   F(StringReplaceGlobalRegExpWithString, 4, 1) \
@@ skipping 702 matching lines @@
 
 class DeclareGlobalsEvalFlag : public BitField<bool, 0, 1> {};
 class DeclareGlobalsNativeFlag : public BitField<bool, 1, 1> {};
 STATIC_ASSERT(LANGUAGE_END == 3);
 class DeclareGlobalsLanguageMode : public BitField<LanguageMode, 2, 2> {};
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_RUNTIME_RUNTIME_H_