port 4490ce85 (r31701).

  original commit message:
    Original issue's description:
    > [es6] Better support for built-ins subclassing.
    >
    > Create proper initial map for original constructor (new.target) instead of doing prototype
    > transition on the base constructor's initial map. This approach fixes in-object slack tracking
    > for subclass instances.
    > This CL also fixes subclassing from String.
    >
    > BUG=v8:3101, v8:3330
    > LOG=Y
    >
    > Committed: https://crrev.com/cd5f48302a502154a0106d12e3066bd563c6340c
    > Cr-Commit-Position: refs/heads/master@{#31680}

    It also fixes typed array map smashing done during typed array initialization.

BUG=

Review URL: https://codereview.chromium.org/1432483003

Cr-Commit-Position: refs/heads/master@{#31704}