[turbofan] Don't try to inling dead nodes.

The JSInliningHeuristic keeps a list of nodes, which might have been
killed by other reducers before the JSInliningHeuristic looks at it
again, so it has to check whether nodes are dead before trying to
expand them later (this is similar to what the ValueNumberingReducer
needs to do with its internal table).

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1508643002

Cr-Commit-Position: refs/heads/master@{#32652}

src/compiler/js-inlining-heuristic.cc

@@ -107,10 +107,13 @@ void JSInliningHeuristic::Finalize() {
     auto i = candidates_.begin();
     Candidate candidate = *i;
     candidates_.erase(i);
-    Reduction r = inliner_.ReduceJSCall(candidate.node, candidate.function);
-    if (r.Changed()) {
-      cumulative_count_ += candidate.function->shared()->ast_node_count();
-      return;
+    // Make sure we don't try to inline dead candidate nodes.
+    if (!candidate.node->IsDead()) {
+      Reduction r = inliner_.ReduceJSCall(candidate.node, candidate.function);
+      if (r.Changed()) {
+        cumulative_count_ += candidate.function->shared()->ast_node_count();
+        return;
+      }
     }
   }
 }