[turbofan] Fix double object allocation when inlining a construct call of a derived class....

src/compiler/js-inlining.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-inlining.h"
 
 #include "src/ast/ast.h"
 #include "src/ast/ast-numbering.h"
 #include "src/ast/scopes.h"
 #include "src/compiler.h"
@@ skipping 282 matching lines @@
                                     frame_state);
 }
 
 namespace {
 
 // TODO(mstarzinger,verwaest): Move this predicate onto SharedFunctionInfo?
 bool NeedsImplicitReceiver(Handle<SharedFunctionInfo> shared_info) {
   DisallowHeapAllocation no_gc;
   Isolate* const isolate = shared_info->GetIsolate();
   Code* const construct_stub = shared_info->construct_stub();
-  return construct_stub != *isolate->builtins()->JSBuiltinsConstructStub();
+  return construct_stub != *isolate->builtins()->JSBuiltinsConstructStub() &&
+         construct_stub !=
+             *isolate->builtins()->JSBuiltinsConstructStubForDerived() &&
+         construct_stub != *isolate->builtins()->JSConstructStubApi();
 }
 
 bool IsNonConstructible(Handle<SharedFunctionInfo> shared_info) {
   DisallowHeapAllocation no_gc;
   Isolate* const isolate = shared_info->GetIsolate();
   Code* const construct_stub = shared_info->construct_stub();
   return construct_stub == *isolate->builtins()->ConstructedNonConstructable();
 }
 
 }  // namespace
@@ skipping 237 matching lines @@
         node, frame_state, call.formal_arguments(),
         FrameStateType::kArgumentsAdaptor, shared_info);
   }
 
   return InlineCall(node, new_target, context, frame_state, start, end);
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8