Remove new.target value from construct stub frames.

src/x64/builtins-x64.cc

Index: src/x64/builtins-x64.cc
diff --git a/src/x64/builtins-x64.cc b/src/x64/builtins-x64.cc
index 22153f6d8e4ecf5a2ec52d282b18808d0692add9..f3b898fdadec640f4e91734b0169e89e25b2caed 100644
--- a/src/x64/builtins-x64.cc
+++ b/src/x64/builtins-x64.cc
@@ -276,10 +276,6 @@ static void Generate_JSConstructStubHelper(MacroAssembler* masm,
       __ SmiToInteger32(rax, rax);
     }
 
-    // Push new.target onto the construct frame. This is stored just below the
-    // receiver on the stack.
-    __ Push(rdx);
-
     if (create_implicit_receiver) {
       // Push the allocated receiver to the stack. We need two copies
       // because we may have to return the original one and the calling
@@ -343,11 +339,11 @@ static void Generate_JSConstructStubHelper(MacroAssembler* masm,
       __ movp(rax, Operand(rsp, 0));
 
       // Restore the arguments count and leave the construct frame. The
-      // arguments count is stored below the reciever and the new.target.
+      // arguments count is stored below the receiver.
       __ bind(&exit);
-      __ movp(rbx, Operand(rsp, 2 * kPointerSize));
+      __ movp(rbx, Operand(rsp, 1 * kPointerSize));
     } else {
-      __ movp(rbx, Operand(rsp, kPointerSize));
+      __ movp(rbx, Operand(rsp, 0));
     }
 
     // Leave construct frame.