[turbofan] Disable bogus lowering of builtin tail-calls.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 9f6700bda614e51e88db0bfaa1521694cbcaeaaf..61d767bbb1aae923463ae0ae8fcc2b22ada131b9 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -1672,6 +1672,7 @@ void ReduceBuiltin(Isolate* isolate, JSGraph* jsgraph, Node* node,
   const bool is_construct = (node->opcode() == IrOpcode::kJSCallConstruct);
 
   DCHECK(Builtins::HasCppImplementation(builtin_index));
+  DCHECK_EQ(0, flags & CallDescriptor::kSupportsTailCalls);
 
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* new_target = is_construct
@@ -1877,7 +1878,8 @@ Reduction JSTypedLowering::ReduceJSCallFunction(Node* node) {
           node, common()->Call(Linkage::GetStubCallDescriptor(
                     isolate(), graph()->zone(), callable.descriptor(),
                     1 + arity, flags)));
-    } else if (is_builtin && Builtins::HasCppImplementation(builtin_index)) {
+    } else if (is_builtin && Builtins::HasCppImplementation(builtin_index) &&

[jgruber, 2016/10/26 11:22:59]

ReduceBuiltin is also called from ReduceJSCallConstruct, should the same check
be added there?

[Michael Starzinger, 2016/10/26 11:35:54]

Acknowledged. Constructor calls cannot be in tail-call position (even when they
syntactically appear as "return new f()" in the code) because the constructor
call chooses the actual return value based on an instance check. This work is
done by the construct stub (which has it's own frame) after the function
returns. This is one of the reasons why constructor calls are not considered
tail-calls by the ECMAScript spec:

http://www.ecma-international.org/ecma-262/6.0/#sec-tail-position-calls

+               ((flags & CallDescriptor::kSupportsTailCalls) == 0)) {
       // Patch {node} to a direct CEntryStub call.
       ReduceBuiltin(isolate(), jsgraph(), node, builtin_index, arity, flags);
     } else {