For non-prototype objects constructed using base==new.target, use the cached constructor to render …

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 8f8908dc98a5346bb2f28c78072ae94222846c33..b01d2f014630dd3ad5e356f0fc93d22e5959b562 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -5485,7 +5485,7 @@ class Map: public HeapObject {
   class IsUnstable : public BitField<bool, 24, 1> {};
   class IsMigrationTarget : public BitField<bool, 25, 1> {};
   class IsStrong : public BitField<bool, 26, 1> {};
-  // Bit 27 is free.
+  class NewTargetIsBase : public BitField<bool, 27, 1> {};
 
   // Keep this bit field at the very end for better code in
   // Builtins::kJSConstructStubGeneric stub.
@@ -5548,6 +5548,8 @@ class Map: public HeapObject {
 
   inline void set_is_strong();
   inline bool is_strong();
+  inline void set_new_target_is_base(bool value);
+  inline bool new_target_is_base();
   inline void set_is_extensible(bool value);
   inline bool is_extensible();
   inline void set_is_prototype_map(bool value);