[crankshaft] Prevent inlining of new.target functions.

test/mjsunit/es6/regress/regress-inlined-new-target.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
-var a = [];
-for (var i = -20; i < 0; ++i) {
-  a[i] = 0;
-}
+function g() { return { val: new.target }; }
+function f() { return (new g()).val; }
 
-function g() {
-    [].push.apply(a, arguments);
-}
-
-function f() {
-  g();
-}
-
-g();
-g();
+assertEquals(g, f());
+assertEquals(g, f());
 %OptimizeFunctionOnNextCall(f);
-f();
+assertEquals(g, f());