[turbofan] escape analysis: check replacement invariant only after fixed-point is reached

We have to ensure that replacements do not have replacements because
otherwise a changed replacement (of the replacement) wouldn't trigger
graph revisitations. However, this invariant can be temporarily
violated when the information propagated along the effect chain is
outdated for another reason. So we should only check this for the final
fixed-point.


Bug: chromium:787959

Change-Id: I4a6b2c4f6ff3205649c0f866654900d4ab126acf
Reviewed-on: https://chromium-review.googlesource.com/817777Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49995}

src/compiler/escape-analysis.cc

@@ -223,8 +223,12 @@ class EscapeAnalysisTracker : public ZoneObject {
       replacement_ = replacement;
       vobject_ =
           replacement ? tracker_->virtual_objects_.Get(replacement) : nullptr;
+      if (replacement) {
         TRACE("Set %s#%d as replacement.\n", replacement->op()->mnemonic(),
               replacement->id());
+      } else {
+        TRACE("Set nullptr as replacement.\n");
+      }
     }
 
     void MarkForDeletion() { SetReplacement(tracker_->jsgraph_->Dead()); }
@@ -248,10 +252,6 @@ class EscapeAnalysisTracker : public ZoneObject {
   Node* GetReplacementOf(Node* node) { return replacements_[node]; }
   Node* ResolveReplacement(Node* node) {
     if (Node* replacement = GetReplacementOf(node)) {
-      // Replacements cannot have replacements. This is important to ensure
-      // re-visitation: If a replacement is replaced, then all nodes accessing
-      // the replacement have to be updated.
-      DCHECK_NULL(GetReplacementOf(replacement));
       return replacement;
     }
     return node;
@@ -768,7 +768,12 @@ EscapeAnalysis::EscapeAnalysis(JSGraph* jsgraph, Zone* zone)
       jsgraph_(jsgraph) {}
 
 Node* EscapeAnalysisResult::GetReplacementOf(Node* node) {
-  return tracker_->GetReplacementOf(node);
+  Node* replacement = tracker_->GetReplacementOf(node);
+  // Replacements cannot have replacements. This is important to ensure
+  // re-visitation: If a replacement is replaced, then all nodes accessing
+  // the replacement have to be updated.
+  if (replacement) DCHECK_NULL(tracker_->GetReplacementOf(replacement));
+  return replacement;
 }
 
 Node* EscapeAnalysisResult::GetVirtualObjectField(const VirtualObject* vobject,