[turbofan] escape analysis: revisit of uses afer FinishRegion marked as escaped

BUG=chromium:699251
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2766383003
Cr-Commit-Position: refs/heads/master@{#44095}

src/compiler/escape-analysis.cc

@@ -881,6 +881,7 @@ void EscapeStatusAnalysis::ProcessFinishRegion(Node* node) {
   }
   if (CheckUsesForEscape(node, true)) {
     RevisitInputs(node);
+    RevisitUses(node);
   }
 }
 

test/mjsunit/compiler/escape-analysis-15.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo --turbo-escape --turbo-experimental --no-turbo-load-elimination
+
+function f(i) {
+  var o1 = {a: 1, b: 2};
+  var o2 = {a: 1, b: 3};
+  var o3 = {a: o2.b};
+  o3.a = "";
+  o2.a = o1;
+  if (i == 4) return o3;
+}
+for (var i = 0; i < 100; ++i){
+  f(i%5)
+}
+%OptimizeFunctionOnNextCall(f);
+f(false);