Version 4.3.61.20 (cherry-pick)

Merged 5f047ff

X87: Handle the case when derived constructor is [[Call]]ed with 0 args.

R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1132573003

Cr-Commit-Position: refs/branch-heads/4.3@{crosswalk-project#24}
Cr-Branched-From: f5c0a23-refs/heads/4.3.61@{#1}
Cr-Branched-From: 0a7d4f4-refs/heads/master@{#27508}

src/x87/code-stubs-x87.cc

@@ -760,8 +760,15 @@ void ArgumentsAccessStub::GenerateNewStrict(MacroAssembler* masm) {
   __ mov(ecx, Operand(edx, ArgumentsAdaptorFrameConstants::kLengthOffset));
 
   if (has_new_target()) {
+    // If the constructor was [[Call]]ed, the call will not push a new.target
+    // onto the stack. In that case the arguments array we construct is bogus,
+    // bu we do not care as the constructor throws immediately.
+    __ cmp(ecx, Immediate(Smi::FromInt(0)));
+    Label skip_decrement;
+    __ j(equal, &skip_decrement);
     // Subtract 1 from smi-tagged arguments count.
     __ sub(ecx, Immediate(2));
+    __ bind(&skip_decrement);
   }
 
   __ lea(edx, Operand(edx, ecx, times_2,