[turbofan] Fix type confusion in NodeProperties::InferReceiverMaps.

For JSCreate nodes with constant inputs we cannot simply assume that the
new.target input is a JSFunction, since it can essentially be any
JSReceiver that is a constructor, i.e. it can also be a JSBoundFunction.

Bug: chromium:801627
Change-Id: Ia37bf9c0a751e4665e1167a3771fbe166473c979
Reviewed-on: https://chromium-review.googlesource.com/866493Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50563}

src/compiler/node-properties.cc

@@ -411,7 +411,8 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
         if (IsSame(receiver, effect)) {
           HeapObjectMatcher mtarget(GetValueInput(effect, 0));
           HeapObjectMatcher mnewtarget(GetValueInput(effect, 1));
-          if (mtarget.HasValue() && mnewtarget.HasValue()) {
+          if (mtarget.HasValue() && mnewtarget.HasValue() &&
+              mnewtarget.Value()->IsJSFunction()) {
             Handle<JSFunction> original_constructor =
                 Handle<JSFunction>::cast(mnewtarget.Value());
             if (original_constructor->has_initial_map()) {

test/mjsunit/regress/regress-crbug-801627.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+class Base {
+  constructor() {
+    this.x = 1;
+  }
+}
+
+class Derived extends Base {
+  constructor() {
+    super();
+  }
+}
+
+// Feed a bound function as new.target
+// to the profiler, so HeapObjectMatcher
+// can find it.
+Reflect.construct(Derived, [], Object.bind());
+%OptimizeFunctionOnNextCall(Derived);
+new Derived();