[turbofan] Fix double object allocation when inlining a construct call of a...

[turbofan] Fix double object allocation when inlining a construct call of a derived class or an Api function.

Review URL: https://codereview.chromium.org/1798373002

Cr-Commit-Position: refs/heads/master@{#34780}

src/compiler/js-inlining.cc

@@ -300,7 +300,10 @@ bool NeedsImplicitReceiver(Handle<SharedFunctionInfo> shared_info) {
   DisallowHeapAllocation no_gc;
   Isolate* const isolate = shared_info->GetIsolate();
   Code* const construct_stub = shared_info->construct_stub();
-  return construct_stub != *isolate->builtins()->JSBuiltinsConstructStub();
+  return construct_stub != *isolate->builtins()->JSBuiltinsConstructStub() &&
+         construct_stub !=
+             *isolate->builtins()->JSBuiltinsConstructStubForDerived() &&
+         construct_stub != *isolate->builtins()->JSConstructStubApi();
 }
 
 bool IsNonConstructible(Handle<SharedFunctionInfo> shared_info) {

test/cctest/test-inobject-slack-tracking.cc

@@ -612,6 +612,8 @@ static void TestClassHierarchy(const std::vector<int>& hierarchy_desc, int n) {
       Handle<JSObject> tmp = Run<JSObject>(new_script);
       CHECK_EQ(initial_map->IsInobjectSlackTrackingInProgress(),
                IsObjectShrinkable(*tmp));
+      CHECK_EQ(Map::kSlackTrackingCounterStart - i - 1,
+               initial_map->construction_counter());
     }
     CHECK(!initial_map->IsInobjectSlackTrackingInProgress());
     CHECK(!IsObjectShrinkable(*obj));