[turbofan] handle dead effect-phi control op in InferReceiverMaps

Add an early exit if the control op is Dead to prevent failing the
DCHECK.

BUG=chromium:797596, v8:5940, v8:3018
R=bmeurer@chromium.org, jarin@chromium.org

Change-Id: I6090380ea69c3205740b6c7a41d7c066d18d6a9f
Reviewed-on: https://chromium-review.googlesource.com/844978
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50312}

src/compiler/node-properties.cc

@@ -464,7 +464,8 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
       case IrOpcode::kEffectPhi: {
         Node* control = GetControlInput(effect);
         if (control->opcode() != IrOpcode::kLoop) {
-          DCHECK_EQ(IrOpcode::kMerge, control->opcode());
+          DCHECK(control->opcode() == IrOpcode::kDead ||
+                 control->opcode() == IrOpcode::kMerge);
           return kNoReceiverMaps;
         }
 

test/mjsunit/compiler/regress-797596.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --allow-natives-syntax
+var notCallable;
+function inferReceiverMapsInDeadCode() {
+  var obj = { func() {} };
+  gc();
+  function wrappedCode() { try { code(); } catch (e) {} }
+  function code() {
+    obj.a;
+    try {
+      Object.defineProperty(obj, "func", { get() {} });
+    } catch (neverCaught) {}
+    for (var i = 0; i < 1; i++) {
+      try {
+        notCallable(arguments[i]);
+      } catch (alwaysCaught) {}
+    }
+  }
+  wrappedCode();
+  try {
+    %OptimizeFunctionOnNextCall(wrappedCode);
+    wrappedCode();
+  } catch (e) {}
+}
+inferReceiverMapsInDeadCode();
+inferReceiverMapsInDeadCode();
+inferReceiverMapsInDeadCode();