[turbofan] Fix logic error in ReduceJSConstruct.

Don't return NoChange when the new_target input to a JSConstruct node is
already a HeapConstant, but rather use that constant in the interesting
lowering below. This was introduced accidentally by 

  https://chromium-review.googlesource.com/604790

earlier. Also don't use ShouldUseCallICFeedback predicate here, as that
doesn't really make sense for JSConstruct, but is mostly interesting for
JSCall (hence the name).

Bug: v8:5517, v8:6399, v8:6679
Change-Id: I96201281cf1a10f2bfd2dc3859455161eb310ccf
Reviewed-on: https://chromium-review.googlesource.com/607887Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47237}

src/compiler/js-call-reducer.cc

@@ -1411,10 +1411,8 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
       NodeProperties::ReplaceValueInput(node, array_function, 1);
       NodeProperties::ChangeOp(node, javascript()->CreateArray(arity, site));
       return Changed(node);
-    } else if (feedback->IsWeakCell()) {
-      // Check if we want to use CallIC feedback here.
-      if (!ShouldUseCallICFeedback(new_target)) return NoChange();
-
+    } else if (feedback->IsWeakCell() &&
+               !HeapObjectMatcher(new_target).HasValue()) {
       Handle<WeakCell> cell = Handle<WeakCell>::cast(feedback);
       if (cell->value()->IsConstructor()) {
         Node* new_target_feedback =