[turbofan] Refine new.target feedback consumption in serializer.

Also use the feedback as a hint for the target, because target and
new.target are often the same and we have no way of checking that
in the serializer.

Bug: v8:7790
Change-Id: I9647bf9ab830a76657de400f413fc1cb798a2ade
Reviewed-on: https://chromium-review.googlesource.com/c/1445988Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59230}

src/compiler/serializer-for-background-compilation.cc

@@ -487,8 +487,9 @@ void SerializerForBackgroundCompilation::ProcessCallOrConstruct(
       broker(), environment()->function().feedback_vector, slot);
   if (feedback.has_value() && feedback->map().is_callable()) {
     if (new_target.has_value()) {
-      // Construct; feedback is new_target.
+      // Construct; feedback is new_target, which often is also the callee.
       new_target->AddConstant(feedback->object());
+      callee.AddConstant(feedback->object());
     } else {
       // Call; feedback is callee.
       callee.AddConstant(feedback->object());

test/cctest/compiler/serializer-tester.cc

@@ -162,6 +162,24 @@ TEST(SerializeCallArguments) {
       "  return j;"
       "}; f(); return f;");
 }
+
+TEST(SerializeConstruct) {
+  CheckForSerializedInlinee(
+      "function g() {};"
+      "function f() {"
+      "  new g(); return g;"
+      "}; f(); return f;");
+}
+
+TEST(SerializeConstructWithSpread) {
+  CheckForSerializedInlinee(
+      "function g(a, b, c) {};"
+      "const arr = [1, 2];"
+      "function f() {"
+      "  new g(0, ...arr); return g;"
+      "}; f(); return f;");
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8