[turbofan] Enable super constructor inlining.

When we inlined a [[Construct]] call to a subclass constructor, we can
also inline the super constructor call (either explicit or implicit),
since we have a concrete JSFunction constant for the subclass and we
can thus constant-fold the %_GetSuperConstructor intrinsic. We don't
need any guards here since the prototype of subclass constructors is
non-writable, non-configurable in ES6.

BUG=v8:5517
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2409423006
Cr-Commit-Position: refs/heads/master@{#40261}

src/compiler/js-intrinsic-lowering.cc

@@ -314,14 +314,27 @@ Reduction JSIntrinsicLowering::ReduceNewObject(Node* node) {
 }
 
 Reduction JSIntrinsicLowering::ReduceGetSuperConstructor(Node* node) {
-  Node* active_function = NodeProperties::GetValueInput(node, 0);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* active_function_map = effect =
-      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                       active_function, effect, control);
-  return Change(node, simplified()->LoadField(AccessBuilder::ForMapPrototype()),
-                active_function_map, effect, control);
+  Node* target = NodeProperties::GetValueInput(node, 0);
+  // The prototype of subclass constructors is non-writable, non-configurable
+  // in ES6, so we don't need to do any checking, but we can just load (or even
+  // constant-fold) the prototype from the {target}.
+  HeapObjectMatcher m(target);
+  if (m.HasValue()) {
+    Handle<JSFunction> target_function = Handle<JSFunction>::cast(m.Value());
+    Node* value = jsgraph()->HeapConstant(handle(
+        JSFunction::cast(target_function->map()->prototype()), isolate()));
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  } else {
+    Node* effect = NodeProperties::GetEffectInput(node);
+    Node* control = NodeProperties::GetControlInput(node);
+    Node* target_map = effect =
+        graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
+                         target, effect, control);
+    return Change(node,
+                  simplified()->LoadField(AccessBuilder::ForMapPrototype()),
+                  target_map, effect, control);
+  }
 }
 
 Reduction JSIntrinsicLowering::Change(Node* node, const Operator* op, Node* a,