[crankshaft] Prevent inlining of new.target functions.

test/mjsunit/es6/regress/regress-inlined-new-target.js

Index: test/mjsunit/es6/regress/regress-inlined-new-target.js
diff --git a/test/mjsunit/array-push12.js b/test/mjsunit/es6/regress/regress-inlined-new-target.js
similarity index 61%
copy from test/mjsunit/array-push12.js
copy to test/mjsunit/es6/regress/regress-inlined-new-target.js
index f4c15b484b41197c9007113ecf8f91fe909cc5d3..59932f6b4cc1c7ca613db765f3178960003448ae 100644
--- a/test/mjsunit/array-push12.js
+++ b/test/mjsunit/es6/regress/regress-inlined-new-target.js
@@ -4,20 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-var a = [];
-for (var i = -20; i < 0; ++i) {
-  a[i] = 0;
-}
+function g() { return { val: new.target }; }
+function f() { return (new g()).val; }
 
-function g() {
-    [].push.apply(a, arguments);
-}
-
-function f() {
-  g();
-}
-
-g();
-g();
+assertEquals(g, f());
+assertEquals(g, f());
 %OptimizeFunctionOnNextCall(f);
-f();
+assertEquals(g, f());