[compiler] Handle Dead nodes in ShouldUseCallICFeedback

If a loop is removed in dead code elimination, we may have a dead node
in the control chain. This wasn't expected, and endless recursion could
result.

Bug: chromium:1196185
Change-Id: Id6d69d0eaed11b0c6158b5643d3433b11611af59
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817792Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73906}

src/compiler/js-call-reducer.cc

@@ -4048,7 +4048,9 @@ bool ShouldUseCallICFeedback(Node* node) {
   } else if (m.IsPhi()) {
     // Protect against endless loops here.
     Node* control = NodeProperties::GetControlInput(node);
-    if (control->opcode() == IrOpcode::kLoop) return false;
+    if (control->opcode() == IrOpcode::kLoop ||
+        control->opcode() == IrOpcode::kDead)
+      return false;
     // Check if {node} is a Phi of nodes which shouldn't
     // use CallIC feedback (not looking through loops).
     int const value_input_count = m.node()->op()->ValueInputCount();

test/mjsunit/compiler/regress-1196185.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --disable-in-process-stack-traces
+// Flags: --gc-interval=500 --stress-compaction
+
+class X {}
+function rando() {}
+
+let named;
+function foo(input) {
+  var b;
+  rando(), {
+    blah: function () { b = b(); },
+  };
+
+  for (var i = 0; i < 10; i++) {
+    var r = rando();
+    var broom;
+
+    try {
+      input[r];
+      named();
+    } catch (e) {}
+
+    try {
+       broom = __v_859.exports.main;
+    } catch (e) {}
+
+    try {
+      for (var j = 0; j < 10; j++) {
+         broom();
+      }
+    } catch (e) {}
+  }
+}
+
+function testfunc() {
+  for (var i = 0; i < 10; i++) {
+    %PrepareFunctionForOptimization(foo);
+    %OptimizeFunctionOnNextCall(foo);
+    foo();
+  }
+}
+testfunc();