Fix Reflect.construct wrt proxy, generator, and non-subclass new.target

src/runtime/runtime-function.cc

Index: src/runtime/runtime-function.cc
diff --git a/src/runtime/runtime-function.cc b/src/runtime/runtime-function.cc
index df717842636b25f37ac942aa1b288534039ea04f..936aebdd1f543104df433598e2ae07731d161f8e 100644
--- a/src/runtime/runtime-function.cc
+++ b/src/runtime/runtime-function.cc
@@ -55,25 +55,26 @@ RUNTIME_FUNCTION(Runtime_CompleteFunctionConstruction) {
   CONVERT_ARG_HANDLE_CHECKED(Object, unchecked_new_target, 2);
   func->shared()->set_name_should_print_as_anonymous(true);
 
+  if (unchecked_new_target->IsUndefined()) return *func;
+
+  Handle<JSReceiver> new_target =
+      Handle<JSReceiver>::cast(unchecked_new_target);
   // If new.target is equal to |constructor| then the function |func| created
   // is already correctly setup and nothing else should be done here.
   // But if new.target is not equal to |constructor| then we are have a
   // Function builtin subclassing case and therefore the function |func|
   // has wrong initial map. To fix that we create a new function object with
   // correct initial map.
-  if (unchecked_new_target->IsUndefined() ||
-      *constructor == *unchecked_new_target) {
-    return *func;
-  }
+  if (*constructor == *new_target) return *func;
 
   // Create a new JSFunction object with correct initial map.
   HandleScope handle_scope(isolate);
-  Handle<JSFunction> new_target =
-      Handle<JSFunction>::cast(unchecked_new_target);
 
   DCHECK(constructor->has_initial_map());
-  Handle<Map> initial_map =
-      JSFunction::EnsureDerivedHasInitialMap(new_target, constructor);
+  Handle<Map> initial_map;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, initial_map,
+      JSFunction::GetDerivedMap(isolate, constructor, new_target));
 
   Handle<SharedFunctionInfo> shared_info(func->shared(), isolate);
   Handle<Context> context(func->context(), isolate);