[deoptimizer] Fix bogus DCHECK in OptimizedFrame::Summarize.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-751715
BUG=chromium:751715

Change-Id: Ibc5d2ce958b6f0c94b41926eb215e81d70833a9d
Reviewed-on: https://chromium-review.googlesource.com/598227Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47108}

src/frames.cc

@@ -1431,10 +1431,10 @@ void OptimizedFrame::Summarize(List<FrameSummary>* frames,
       is_constructor = false;
     } else if (it->kind() == TranslatedFrame::kConstructStub) {
       // The next encountered JS frame will be marked as a constructor call.
+      DCHECK(!is_constructor);
       is_constructor = true;
     }
   }
-  DCHECK(!is_constructor);
 }
 
 

test/mjsunit/regress/regress-crbug-751715.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class Base {}
+class Derived extends Base {
+  constructor() { super(); }
+}
+var proxy = new Proxy(Base, { get() {} });
+assertDoesNotThrow(() => Reflect.construct(Derived, []));
+assertThrows(() => Reflect.construct(Derived, [], proxy), TypeError);
+assertThrows(() => Reflect.construct(Derived, [], proxy), TypeError);
+%OptimizeFunctionOnNextCall(Derived);
+assertThrows(() => Reflect.construct(Derived, [], proxy), TypeError);