Fix Function subclassing.

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/api-natives.h"
 #include "src/code-stubs.h"
 #include "src/extensions/externalize-string-extension.h"
@@ skipping 1063 matching lines @@
       factory->NewScriptContextTable();
   native_context()->set_script_context_table(*script_context_table);
   InstallGlobalThisBinding();
 
   Handle<String> object_name = factory->Object_string();
   JSObject::AddProperty(
       global_object, object_name, isolate->object_function(), DONT_ENUM);
 
   Handle<JSObject> global(native_context()->global_object());
 
-
-  {  // Install global Function object
+  {  // --- F u n c t i o n ---
     Handle<JSFunction> function_function =
         InstallFunction(global, "Function", JS_FUNCTION_TYPE, JSFunction::kSize,
                         empty_function, Builtins::kIllegal);
-    function_function->initial_map()->set_is_callable();
-    function_function->initial_map()->set_is_constructor(true);
+    function_function->set_prototype_or_initial_map(
+        *sloppy_function_map_writable_prototype_);
     function_function->shared()->set_construct_stub(
         *isolate->builtins()->JSBuiltinsConstructStub());
     InstallWithIntrinsicDefaultProto(isolate, function_function,
                                      Context::FUNCTION_FUNCTION_INDEX);
+
+    sloppy_function_map_writable_prototype_->SetConstructor(*function_function);
+    strict_function_map_writable_prototype_->SetConstructor(*function_function);
+    native_context()->strong_function_map()->SetConstructor(*function_function);
   }
 
   {  // --- A r r a y ---
     Handle<JSFunction> array_function =
         InstallFunction(global, "Array", JS_ARRAY_TYPE, JSArray::kSize,
                         isolate->initial_object_prototype(),
                         Builtins::kArrayCode);
     array_function->shared()->DontAdaptArguments();
     array_function->shared()->set_function_data(Smi::FromInt(kArrayCode));
 
@@ skipping 760 matching lines @@
 
     JSObject::AddProperty(
         container, factory->InternalizeUtf8String("GeneratorFunctionPrototype"),
         generator_function_prototype, NONE);
 
     static const bool kUseStrictFunctionMap = true;
     Handle<JSFunction> generator_function_function =
         InstallFunction(container, "GeneratorFunction", JS_FUNCTION_TYPE,
                         JSFunction::kSize, generator_function_prototype,
                         Builtins::kIllegal, kUseStrictFunctionMap);
-    generator_function_function->initial_map()->set_is_callable();
-    generator_function_function->initial_map()->set_is_constructor(true);
+    generator_function_function->set_prototype_or_initial_map(
+        native_context->sloppy_generator_function_map());
     generator_function_function->shared()->set_construct_stub(
         *isolate->builtins()->JSBuiltinsConstructStub());
     InstallWithIntrinsicDefaultProto(
         isolate, generator_function_function,
         Context::GENERATOR_FUNCTION_FUNCTION_INDEX);
+
+    native_context->sloppy_generator_function_map()->SetConstructor(
+        *generator_function_function);
+    native_context->strict_generator_function_map()->SetConstructor(
+        *generator_function_function);
+    native_context->strong_generator_function_map()->SetConstructor(
+        *generator_function_function);
   }
 
   {  // -- S e t I t e r a t o r
     Handle<JSObject> set_iterator_prototype =
         isolate->factory()->NewJSObject(isolate->object_function(), TENURED);
     SetObjectPrototype(set_iterator_prototype, iterator_prototype);
     Handle<JSFunction> set_iterator_function = InstallFunction(
         container, "SetIterator", JS_SET_ITERATOR_TYPE, JSSetIterator::kSize,
         set_iterator_prototype, Builtins::kIllegal);
     native_context->set_set_iterator_map(set_iterator_function->initial_map());
@@ skipping 1402 matching lines @@
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   DCHECK(!IsActive());
 }
 
 }  // namespace internal
 }  // namespace v8