[turbofan] Fix lowering of %_GetSuperConstructor intrinsic.

The above intrinsic by now has to perform a check whether the prototype
of a derived constructor is actually a constructor function itself. This
is done as part of the {JSGetConstructorCall} operator. The intrinsic
should just reduce down to the operator to maintain correct semantics.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-696622
BUG=chromium:696622

Change-Id: Ia19c188f17ad16b12248db1f01a01b8d7258499b
Reviewed-on: https://chromium-review.googlesource.com/447716Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43479}

src/compiler/js-intrinsic-lowering.cc

@@ -313,14 +313,8 @@ Reduction JSIntrinsicLowering::ReduceCall(Node* node) {
 }
 
 Reduction JSIntrinsicLowering::ReduceGetSuperConstructor(Node* node) {
-  Node* active_function = NodeProperties::GetValueInput(node, 0);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* active_function_map = effect =
-      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                       active_function, effect, control);
-  return Change(node, simplified()->LoadField(AccessBuilder::ForMapPrototype()),
-                active_function_map, effect, control);
+  NodeProperties::ChangeOp(node, javascript()->GetSuperConstructor());
+  return Changed(node);
 }
 
 Reduction JSIntrinsicLowering::ReduceArrayBufferViewField(

src/interpreter/bytecode-decoder.cc

@@ -74,7 +74,7 @@ const char* NameForRuntimeId(uint32_t idx) {
   case Runtime::k##name:           \
     return #name;                  \
   case Runtime::kInline##name:     \
-    return #name;
+    return "_" #name;
     FOR_EACH_INTRINSIC(CASE)
 #undef CASE
     default:

test/mjsunit/regress/regress-crbug-696622.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class C {}
+class D extends C { constructor() { super(...unresolved, 75) } }
+D.__proto__ = null;
+
+assertThrows(() => new D(), TypeError);
+assertThrows(() => new D(), TypeError);
+%OptimizeFunctionOnNextCall(D);
+assertThrows(() => new D(), TypeError);