Create proper initial map for original constructor (new.target) instead of doing prototype transition on the base constructor's initial map. This approach fixes in-object slack tracking for subclass instances.
This CL also fixes subclassing from String.

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1427483002

Cr-Commit-Position: refs/heads/master@{#31680}