[turbofan] When inlining JSCallConstruct receiver should be set to the hole.

When inlining JSCallConstruct in turbofan, receiver is initialized to model
the behaviour of constructor. When an implicit receiver is not required the
receiver value should be set to the hole value instead of undefined value.
When initializing the receiver via super calls, we check that the receiver
is the hole value.

BUG=chromium:653407

Review-Url: https://codereview.chromium.org/2424123002
Cr-Commit-Position: refs/heads/master@{#40396}

src/compiler/js-inlining.cc

@@ -590,7 +590,7 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
     // constructor dispatch (allocate implicit receiver and check return value).
     // This models the behavior usually accomplished by our {JSConstructStub}.
     // Note that the context has to be the callers context (input to call node).
-    Node* receiver = jsgraph()->UndefinedConstant();  // Implicit receiver.
+    Node* receiver = jsgraph()->TheHoleConstant();  // Implicit receiver.
     if (NeedsImplicitReceiver(shared_info)) {
       Node* frame_state_before = NodeProperties::FindFrameStateBefore(node);
       Node* effect = NodeProperties::GetEffectInput(node);

test/mjsunit/regress/regress-653407.js

@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --ignition --turbo
+
+// This is to test if 'this' gets correctly initialized when inlining
+// constructors in turbofan.
+
+class superClass {
+  constructor () {}
+}
+
+class subClass extends superClass {
+  constructor () {
+    super();
+  }
+}
+
+function f() {
+ new subClass();
+}
+
+f(); // We need this to collect feedback, so that subClass gets inlined in f.
+%OptimizeFunctionOnNextCall(f)
+f();