[turbofan] Remove unnecessary FrameState when inlining constructors

Bug: v8:14192
Change-Id: I3f52e70ee1dd7ea99d45b4e7ba6329a438e9b31e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4694002
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#89008}

src/compiler/js-inlining.cc

@@ -56,9 +56,7 @@ class JSCallAccessor {
     return call_->InputAt(JSCallOrConstructNode::TargetIndex());
   }
 
-  Node* receiver() const {
-    return JSCallNode{call_}.receiver();
-  }
+  Node* receiver() const { return JSCallNode{call_}.receiver(); }
 
   Node* new_target() const { return JSConstructNode{call_}.new_target(); }
 
@@ -831,10 +829,18 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
     if (NeedsImplicitReceiver(*shared_info)) {
       Effect effect = n.effect();
       Control control = n.control();
-      Node* frame_state_inside = CreateArtificialFrameState(
-          node, frame_state, n.ArgumentCount(),
-          BytecodeOffset::ConstructStubCreate(), FrameStateType::kConstructStub,
-          *shared_info, caller_context);
+      Node* frame_state_inside;
+      HeapObjectMatcher m(new_target);
+      if (m.HasResolvedValue() && m.Ref(broker()).IsJSFunction()) {
+        // If {new_target} is a JSFunction, then we cannot deopt in the
+        // NewObject call. Therefore we do not need the artificial frame state.
+        frame_state_inside = frame_state;
+      } else {
+        frame_state_inside = CreateArtificialFrameState(
+            node, frame_state, n.ArgumentCount(),
+            BytecodeOffset::ConstructStubCreate(),
+            FrameStateType::kConstructStub, *shared_info, caller_context);
+      }
       Node* create =
           graph()->NewNode(javascript()->Create(), call.target(), new_target,
                            caller_context, frame_state_inside, effect, control);