[runtime] Sanitize %NewClosure runtime entries.

test/unittests/compiler/js-typed-lowering-unittest.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/machine-operator.h"
@@ skipping 1020 matching lines @@
 // JSCreateClosure
 
 
 TEST_F(JSTypedLoweringTest, JSCreateClosure) {
   Node* const context = UndefinedConstant();
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
   Handle<SharedFunctionInfo> shared(isolate()->object_function()->shared());
   Reduction r =
       Reduce(graph()->NewNode(javascript()->CreateClosure(shared, NOT_TENURED),
-                              context, context, effect, control));
+                              context, effect, control));
   ASSERT_TRUE(r.Changed());
   EXPECT_THAT(r.replacement(),
               IsCall(_, IsHeapConstant(CodeFactory::FastNewClosure(
                                            isolate(), shared->language_mode(),
                                            shared->kind()).code()),
                      IsHeapConstant(shared), effect, control));
 }
 
 
 // -----------------------------------------------------------------------------
@@ skipping 63 matching lines @@
   EXPECT_THAT(r.replacement(),
               IsFinish(IsAllocate(IsNumberConstant(Context::SizeFor(
                                       Context::MIN_CONTEXT_SLOTS)),
                                   effect, control),
                        _));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8