[runtime] Throw exception for derived constructors in correct context.

src/runtime/runtime-classes.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include <stdlib.h>
 #include <limits>
 
 #include "src/arguments.h"
@@ skipping 130 matching lines @@
   Handle<String> name_string = name->IsString()
                                    ? Handle<String>::cast(name)
                                    : isolate->factory()->empty_string();
   constructor->shared()->set_name(*name_string);
 
   if (!super_class->IsTheHole()) {
     // Derived classes, just like builtins, don't create implicit receivers in
     // [[construct]]. Instead they just set up new.target and call into the
     // constructor. Hence we can reuse the builtins construct stub for derived
     // classes.
-    Handle<Code> stub(isolate->builtins()->JSBuiltinsConstructStub());
+    Handle<Code> stub(isolate->builtins()->JSBuiltinsConstructStubForDerived());
     constructor->shared()->set_construct_stub(*stub);
   }
 
   JSFunction::SetPrototype(constructor, prototype);
   PropertyAttributes attribs =
       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
   RETURN_ON_EXCEPTION(isolate,
                       JSObject::SetOwnPropertyIgnoreAttributes(
                           constructor, isolate->factory()->prototype_string(),
                           prototype, attribs),
@@ skipping 304 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_GetSuperConstructor) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_CHECKED(JSFunction, active_function, 0);
   return active_function->map()->prototype();
 }
 
 }  // namespace internal
 }  // namespace v8