[crankshaft] Pass new.target to direct function calls.

src/crankshaft/x64/lithium-codegen-x64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/crankshaft/x64/lithium-codegen-x64.h"
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
@@ skipping 3350 matching lines @@
   bool can_invoke_directly =
       dont_adapt_arguments || formal_parameter_count == arity;
 
   Register function_reg = rdi;
   LPointerMap* pointers = instr->pointer_map();
 
   if (can_invoke_directly) {
     // Change context.
     __ movp(rsi, FieldOperand(function_reg, JSFunction::kContextOffset));
 
-    // Always initialize rax to the number of actual arguments.
+    // Always initialize new target and number of actual arguments.
+    __ LoadRoot(rdx, Heap::kUndefinedValueRootIndex);
     __ Set(rax, arity);
 
     // Invoke function.
     if (function.is_identical_to(info()->closure())) {
       __ CallSelf();
     } else {
       __ Call(FieldOperand(function_reg, JSFunction::kCodeEntryOffset));
     }
 
     // Set up deoptimization.
@@ skipping 43 matching lines @@
     }
     generator.AfterCall();
   }
 }
 
 
 void LCodeGen::DoCallJSFunction(LCallJSFunction* instr) {
   DCHECK(ToRegister(instr->function()).is(rdi));
   DCHECK(ToRegister(instr->result()).is(rax));
 
-  __ Set(rax, instr->arity());
-
   // Change context.
   __ movp(rsi, FieldOperand(rdi, JSFunction::kContextOffset));
 
+  // Always initialize new target and number of actual arguments.
+  __ LoadRoot(rdx, Heap::kUndefinedValueRootIndex);
+  __ Set(rax, instr->arity());
+
   LPointerMap* pointers = instr->pointer_map();
   SafepointGenerator generator(this, pointers, Safepoint::kLazyDeopt);
 
   bool is_self_call = false;
   if (instr->hydrogen()->function()->IsConstant()) {
     Handle<JSFunction> jsfun = Handle<JSFunction>::null();
     HConstant* fun_const = HConstant::cast(instr->hydrogen()->function());
     jsfun = Handle<JSFunction>::cast(fun_const->handle(isolate()));
     is_self_call = jsfun.is_identical_to(info()->closure());
   }
@@ skipping 2399 matching lines @@
   RecordSafepoint(Safepoint::kNoLazyDeopt);
 }
 
 
 #undef __
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X64