[turbofan] Lower JSCreate to an inline allocation in JSTypedLowering.

test/unittests/compiler/js-typed-lowering-unittest.cc

Index: test/unittests/compiler/js-typed-lowering-unittest.cc
diff --git a/test/unittests/compiler/js-typed-lowering-unittest.cc b/test/unittests/compiler/js-typed-lowering-unittest.cc
index 37dc1f3eb54864bd506a5a6a277f522363712b8f..a66c1b94ce00ff7e5aa439571d8d9c93b732629f 100644
--- a/test/unittests/compiler/js-typed-lowering-unittest.cc
+++ b/test/unittests/compiler/js-typed-lowering-unittest.cc
@@ -979,6 +979,27 @@ TEST_F(JSTypedLoweringTest, JSAddWithString) {
 
 
 // -----------------------------------------------------------------------------
+// JSCreate
+
+
+TEST_F(JSTypedLoweringTest, JSCreate) {
+  Handle<JSFunction> function = isolate()->object_function();
+  Node* const target = Parameter(Type::Constant(function, graph()->zone()));
+  Node* const context = Parameter(Type::Any());
+  Node* const effect = graph()->start();
+  Reduction r = Reduce(graph()->NewNode(javascript()->Create(), target, target,
+                                        context, effect));
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(
+      r.replacement(),
+      IsFinishRegion(
+          IsAllocate(IsNumberConstant(function->initial_map()->instance_size()),
+                     IsBeginRegion(effect), _),
+          _));
+}
+
+
+// -----------------------------------------------------------------------------
 // JSCreateArguments