Fix uninitialized new.target register in InvokeBuiltin.

src/arm/macro-assembler-arm.cc

Index: src/arm/macro-assembler-arm.cc
diff --git a/src/arm/macro-assembler-arm.cc b/src/arm/macro-assembler-arm.cc
index f8ee94503d4991498d8bb756df7eea92dc149bda..f463dddd3f9e419b45ab1938d2b00ffbcc7049ba 100644
--- a/src/arm/macro-assembler-arm.cc
+++ b/src/arm/macro-assembler-arm.cc
@@ -2517,6 +2517,9 @@ void MacroAssembler::InvokeBuiltin(int native_context_index, InvokeFlag flag,
   // You can't call a builtin without a valid frame.
   DCHECK(flag == JUMP_FUNCTION || has_frame());
 
+  // Always initialize new target.
+  LoadRoot(r3, Heap::kUndefinedValueRootIndex);
+
   LoadNativeContextSlot(native_context_index, r1);
   ldr(r2, FieldMemOperand(r1, JSFunction::kCodeEntryOffset));
   if (flag == CALL_FUNCTION) {