[nci] Fix arguments order in call of ConstructWithSpread_WithFeedback

ConstructWithSpread_WithFeedback uses the same argument order as JS linkage, therefore arguments should be inserted in reversed order.
See https://source.chromium.org/chromium/chromium/src/+/master:v8/src/codegen/interface-descriptors.h;drc=c7cb9beca18d98ba83c3b75860b912219d425d0e;l=507

Change-Id: I4d3ded048a08ba9a2a4d30da4c41044d9669becc
Bug: chromium:1145990
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549952
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71341}

src/compiler/js-generic-lowering.cc

@@ -1014,10 +1014,14 @@ void JSGenericLowering::LowerJSConstructWithSpread(Node* node) {
     node->InsertInput(zone(), 0, stub_code);
     node->InsertInput(zone(), 3, stub_arity);
     node->InsertInput(zone(), 4, slot);
-    node->InsertInput(zone(), 5, spread);
-    node->InsertInput(zone(), 6, feedback_vector);
+    // Arguments in the stack should be inserted in reversed order, ie, the last
+    // arguments defined in the interface descriptor should be inserted first.
+    DCHECK_EQ(callable.descriptor().GetStackArgumentOrder(),
+              StackArgumentOrder::kJS);
+    node->InsertInput(zone(), 5, feedback_vector);
+    node->InsertInput(zone(), 6, spread);
     node->InsertInput(zone(), 7, receiver);
-    // After: {code, target, new_target, arity, slot, spread, vector, receiver,
+    // After: {code, target, new_target, arity, slot, vector, spread, receiver,
     // ...args}.
 
     NodeProperties::ChangeOp(node, common()->Call(call_descriptor));

test/mjsunit/regress/regress-1145990.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class B { }
+
+class C extends B {
+  #field = 'test';
+}
+
+for (let i = 0; i < 10000; i++) {
+  new C();
+}