Fix Function subclassing.

src/runtime/runtime-function.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/accessors.h"
 #include "src/arguments.h"
 #include "src/compiler.h"
 #include "src/deoptimizer.h"
@@ skipping 59 matching lines @@
   // Create a new JSFunction object with correct initial map.
   HandleScope handle_scope(isolate);
 
   DCHECK(constructor->has_initial_map());
   Handle<Map> initial_map;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, initial_map,
       JSFunction::GetDerivedMap(isolate, constructor, new_target));
 
   Handle<SharedFunctionInfo> shared_info(func->shared(), isolate);
+  Handle<Map> map = Map::AsLanguageMode(
+      initial_map, shared_info->language_mode(), shared_info->kind());
+
   Handle<Context> context(func->context(), isolate);
   Handle<JSFunction> result =
       isolate->factory()->NewFunctionFromSharedFunctionInfo(
-          initial_map, shared_info, context, NOT_TENURED);
+          map, shared_info, context, NOT_TENURED);
   DCHECK_EQ(func->IsConstructor(), result->IsConstructor());
   return *result;
 }
 
 
 RUNTIME_FUNCTION(Runtime_FunctionIsArrow) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 1);
   CONVERT_ARG_CHECKED(JSFunction, f, 0);
   return isolate->heap()->ToBoolean(f->shared()->is_arrow());
@@ skipping 518 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_ThrowStrongModeTooFewArguments) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 0);
   THROW_NEW_ERROR_RETURN_FAILURE(isolate,
                                  NewTypeError(MessageTemplate::kStrongArity));
 }
 
 }  // namespace internal
 }  // namespace v8