[turbofan] Fix bug in object state generation of escape analysis.

Apparently, some StateValues have other StateValues as input. This
CL makes escape analysis transformation phase aware of it.

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1581183004

Cr-Commit-Position: refs/heads/master@{#33285}

src/compiler/escape-analysis-reducer.cc

@@ -246,7 +246,14 @@ Node* EscapeAnalysisReducer::ReduceStateValueInputs(Node* node, Node* effect,
   DCHECK_NOT_NULL(effect);
   Node* clone = nullptr;
   for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
-    if (Node* ret = ReduceStateValueInput(node, i, effect, multiple_users)) {
+    Node* input = NodeProperties::GetValueInput(node, i);
+    Node* ret = nullptr;
+    if (input->opcode() == IrOpcode::kStateValues) {
+      ret = ReduceStateValueInputs(input, effect, multiple_users);
+    } else {
+      ret = ReduceStateValueInput(node, i, effect, multiple_users);
+    }
+    if (ret) {
       node = ret;
       DCHECK_NULL(clone);
       clone = ret;