[turbofan] Ignore pretenure flag for JSCreateClosure.

As part of https://chromium-review.googlesource.com/902283 I changed the
JSCreateClosure lowering to respect the pretenure flag on the operator,
but that tanks some benchmarks heavily, as the Parser marks closures
like

  args[l] = function(...) { ... }

for old-space allocation, which backfires for short-living closures.

Bug: v8:7253, chromium:810132
Change-Id: I66f048553d9f2a70b2691537e726128f3fb01563
Reviewed-on: https://chromium-review.googlesource.com/910849Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51203}

src/compiler/js-create-lowering.cc

@@ -928,10 +928,21 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   DCHECK(!function_map->IsInobjectSlackTrackingInProgress());
   DCHECK(!function_map->is_dictionary_map());
 
+  // TODO(turbofan): We should use the pretenure flag from {p} here,
+  // but currently the heuristic in the parser works against us, as
+  // it marks closures like
+  //
+  //   args[l] = function(...) { ... }
+  //
+  // for old-space allocation, which doesn't always make sense. For
+  // example in case of the bluebird-parallel benchmark, where this
+  // is a core part of the *promisify* logic (see crbug.com/810132).
+  PretenureFlag pretenure = NOT_TENURED;
+
   // Emit code to allocate the JSFunction instance.
   STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
   AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(function_map->instance_size(), p.pretenure(), Type::Function());
+  a.Allocate(function_map->instance_size(), pretenure, Type::Function());
   a.Store(AccessBuilder::ForMap(), function_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
           jsgraph()->EmptyFixedArrayConstant());