[turbofan] Fully reduce node in JSCallReducer::ReduceSpreadCall.

When turning a JSCallWithSpread into a JSCall or a JSConstructWithSpread
into a JSConstruct, we need to (manually) invoke the JSCallReducer logic
again on the changed node to make sure that optimizations that are now
possible for the JSCall or JSConstruct operator are properly applied.

BUG=v8:5932,v8:5895,v8:6344,v8:6399,v8:6400
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2882153003
Cr-Commit-Position: refs/heads/master@{#45325}

src/compiler/js-call-reducer.cc

@@ -506,10 +506,13 @@ Reduction JSCallReducer::ReduceSpreadCall(Node* node, int arity) {
   // through here.
   if (node->opcode() == IrOpcode::kJSCallWithSpread) {
     NodeProperties::ChangeOp(node, javascript()->Call(arity + 1));
+    Reduction const r = ReduceJSCall(node);
+    return r.Changed() ? r : Changed(node);
   } else {
     NodeProperties::ChangeOp(node, javascript()->Construct(arity + 2));
+    Reduction const r = ReduceJSConstruct(node);
+    return r.Changed() ? r : Changed(node);
   }
-  return Changed(node);
 }
 
 namespace {