port 8196c28a (r29238).

original commit message:

  JSConstructStub for subclass constructors instead locates new.target in
  a known location on the stack.

BUG=

Review URL: https://codereview.chromium.org/1207613003

Cr-Commit-Position: refs/heads/master@{#29398}