FunctionAnalysis: Allow CacheNewObject to use new.target

Summary:
`new.target` was considered to escape if the callee ever used
NewTargetParam, which is overly restrictive in light of CacheNewObject,
which we know won't let it escape.

Allow it to be used in FunctionAnalysis without returning `true` from
`canEscapeThroughCall`.

Reviewed By: neildhar

Differential Revision: D66395118

fbshipit-source-id: 399f029ca24a35b8171ce29fcbc203fd92e82585

lib/Optimizer/Scalar/FunctionAnalysis.cpp

@@ -67,10 +67,24 @@ bool canEscapeThroughCall(Instruction *C, Function *F, BaseCallInst *CI) {
       return true;
 
   // Check if the closure is passed as the new.target argument, and the function
-  // actually uses it.
-  // TODO: Allow certain instructions to use new.target.
-  if (C == CI->getNewTarget() && F->getNewTargetParam()->hasUsers())
-    return true;
+  // actually uses it in a way that can escape.
+  if (C == CI->getNewTarget()) {
+    // If NewTargetParam has no users, the closure can't escape through it.
+    // Check all the users to see if there's any that might let it escape.
+    for (auto *newTargetUser : F->getNewTargetParam()->getUsers()) {
+      auto *getNewTarget = llvh::dyn_cast<GetNewTargetInst>(newTargetUser);
+      if (!getNewTarget) {
+        // Unknown user of NewTargetParam.
+        return true;
+      }
+      for (auto *getNewTargetUser : getNewTarget->getUsers()) {
+        // Certain instructions are known not to leak new.target even if they
+        // use it.
+        if (!llvh::isa<CacheNewObjectInst>(getNewTargetUser))
+          return true;
+      }
+    }
+  }
 
   return false;
 }