[runtime] Sanitize %NewClosure runtime entries.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 1099 matching lines @@
   // functions that don't need literals cloning.
   if (p.pretenure() == NOT_TENURED && shared->num_literals() == 0) {
     Isolate* isolate = jsgraph()->isolate();
     Callable callable = CodeFactory::FastNewClosure(
         isolate, shared->language_mode(), shared->kind());
     CallDescriptor* desc = Linkage::GetStubCallDescriptor(
         isolate, graph()->zone(), callable.descriptor(), 0,
         CallDescriptor::kNoFlags);
     const Operator* new_op = common()->Call(desc);
     Node* stub_code = jsgraph()->HeapConstant(callable.code());
-    node->ReplaceInput(0, jsgraph()->HeapConstant(shared));
     node->InsertInput(graph()->zone(), 0, stub_code);
+    node->InsertInput(graph()->zone(), 1, jsgraph()->HeapConstant(shared));
     node->set_op(new_op);
     return Changed(node);
   }
 
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSCreateLiteralArray(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateLiteralArray, node->opcode());
@@ skipping 576 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8