`delete new.target` should return true

This brings V8's behavior in line with both the spec and with
other engines.

This also fixes the (now-incorrect) DCHECK in BytecodeGenerator relating
to the delete operator's application to a VariableProxy.

Bug: v8:6697, v8:6721
Change-Id: I413c02af235b0bb652eb4c5d5c971e2cf80e0906
Reviewed-on: https://chromium-review.googlesource.com/703894Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48346}

src/interpreter/bytecode-generator.cc

@@ -3477,13 +3477,15 @@ void BytecodeGenerator::VisitDelete(UnaryOperation* expr) {
     builder()->Delete(object, language_mode());
   } else if (expr->expression()->IsVariableProxy()) {
     // Delete of an unqualified identifier is allowed in sloppy mode but is
-    // not allowed in strict mode. Deleting 'this' is allowed in both modes.
+    // not allowed in strict mode. Deleting 'this' and 'new.target' is allowed
+    // in both modes.
     VariableProxy* proxy = expr->expression()->AsVariableProxy();
-    Variable* variable = proxy->var();
-    DCHECK(is_sloppy(language_mode()) || variable->is_this());
-    if (variable->is_this()) {
+    DCHECK(is_sloppy(language_mode()) || proxy->is_this() ||
+           proxy->is_new_target());
+    if (proxy->is_this() || proxy->is_new_target()) {
       builder()->LoadTrue();
     } else {
+      Variable* variable = proxy->var();
       switch (variable->location()) {
         case VariableLocation::PARAMETER:
         case VariableLocation::LOCAL:

test/mjsunit/es6/new-target.js

@@ -472,3 +472,12 @@ function get_new_target() { return new.target; }
   tagNewTargetProp.Prop = C;
   assertEquals(new tagNewTargetProp, ["tagNewTargetProp"]);
 })();
+
+(function testDeleteSloppy() {
+  assertTrue(delete new.target);
+})();
+
+(function testDeleteStrict() {
+  "use strict";
+  assertTrue(delete new.target);
+})();