[turbofan] Fix serialization of Construct bytecode

The serialization of Construct was accidentally using the wrong hints
for the receiver. Also, the recursion in ProcessCallOrConstruct was
not quite right: for example, it overwrote the accumulator hints in
each recursion.

With this CL the Octane raytrace score for --concurrent-inlining is
back to the default configuration's score.

Bug: v8:7790
Change-Id: I501c9cc0b0c8de04520742b9c6b392a4a732bf78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1921789
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65011}

test/mjsunit/compiler/construct-receiver.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class C {
+  bla() {};
+  constructor() { %TurbofanStaticAssert(this.bla === bla); }
+}
+const bla = C.prototype.bla;
+function bar(f) { return new f; }
+var CC = C;
+function foo() { return bar(CC); }
+
+%PrepareFunctionForOptimization(C);
+%PrepareFunctionForOptimization(bla);
+%PrepareFunctionForOptimization(foo);
+%PrepareFunctionForOptimization(bar);
+
+// Make {this.bla} in C megamorphic
+new class extends C { constructor() { super(); this.a = 1 } }
+new class extends C { constructor() { super(); this.b = 1 } }
+new class extends C { constructor() { super(); this.c = 1 } }
+new class extends C { constructor() { super(); this.d = 1 } }
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();