[turbofan] Pass new target to JSCreate nodes.

This passes both, the actual constructor and the original constructor,
to nodes having the {JSCreate} operator. This is required for allocating
properly subclassed implicit receiver objects.

R=verwaest@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1434873004

Cr-Commit-Position: refs/heads/master@{#31955}

src/compiler/js-generic-lowering.cc

@@ -457,9 +457,6 @@ void JSGenericLowering::LowerJSLoadDynamic(Node* node) {
 
 
 void JSGenericLowering::LowerJSCreate(Node* node) {
-  // TODO(4544): The duplication of the constructor function is only valid if
-  // actual constructor and original constructor coincide. Fix this!
-  node->InsertInput(zone(), 1, node->InputAt(0));  // Duplicate constructor.
   ReplaceWithRuntimeCall(node, Runtime::kNewObject);
 }
 

src/compiler/js-inlining.cc

@@ -452,12 +452,12 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
   if (node->opcode() == IrOpcode::kJSCallConstruct) {
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* context = NodeProperties::GetContextInput(node);
-    Node* create = jsgraph_->graph()->NewNode(jsgraph_->javascript()->Create(),
-                                              call.target(), context, effect);
+    Node* create = jsgraph_->graph()->NewNode(
+        jsgraph_->javascript()->Create(), call.target(),
+        call.original_constructor(), context, effect);
     NodeProperties::ReplaceEffectInput(node, create);
-    // TODO(4544): For now {JSCreate} requires the actual constructor to
-    // coincide with the original constructor. Adapt JSGenericLowering to fix.
-    // Also Runtime_GetOriginalConstructor depends on this for now. Fix as well!
+    // TODO(4544): For now Runtime_GetOriginalConstructor depends on the actual
+    // constructor to coincide with the original constructor. Fix this!
     CHECK_EQ(call.target(), call.original_constructor());
     // TODO(4544): For derived constructors we should not allocate an implicit
     // receiver and also the return value should not be checked afterwards.

src/compiler/js-operator.cc

@@ -363,7 +363,7 @@ const CreateClosureParameters& CreateClosureParametersOf(const Operator* op) {
   V(ToName, Operator::kNoProperties, 1, 1)            \
   V(ToObject, Operator::kNoProperties, 1, 1)          \
   V(Yield, Operator::kNoProperties, 1, 1)             \
-  V(Create, Operator::kEliminatable, 1, 1)            \
+  V(Create, Operator::kEliminatable, 2, 1)            \
   V(HasProperty, Operator::kNoProperties, 2, 1)       \
   V(TypeOf, Operator::kEliminatable, 1, 1)            \
   V(InstanceOf, Operator::kNoProperties, 2, 1)        \

test/unittests/compiler/js-operator-unittest.cc

@@ -78,7 +78,7 @@ const SharedOperator kSharedOperators[] = {
     SHARED(ToName, Operator::kNoProperties, 1, 1, 1, 1, 1, 1, 2),
     SHARED(ToObject, Operator::kNoProperties, 1, 1, 1, 1, 1, 1, 2),
     SHARED(Yield, Operator::kNoProperties, 1, 0, 1, 1, 1, 1, 2),
-    SHARED(Create, Operator::kEliminatable, 1, 0, 1, 0, 1, 1, 0),
+    SHARED(Create, Operator::kEliminatable, 2, 0, 1, 0, 1, 1, 0),
     SHARED(HasProperty, Operator::kNoProperties, 2, 1, 1, 1, 1, 1, 2),
     SHARED(TypeOf, Operator::kEliminatable, 1, 0, 1, 0, 1, 1, 0),
     SHARED(InstanceOf, Operator::kNoProperties, 2, 1, 1, 1, 1, 1, 2),