[turbofan] Fix control reducer for degenerate cases of self-loop branches.

R=jarin@chromium.org
BUG=chromium:447526

Review URL: https://codereview.chromium.org/828823006

Cr-Commit-Position: refs/heads/master@{#26009}

src/compiler/control-reducer.cc

@@ -282,6 +282,7 @@ class ControlReducerImpl {
 
     // Recurse on an input if necessary.
     for (Node* const input : node->inputs()) {
+      CHECK_NE(NULL, input);
       if (Recurse(input)) return;
     }
 
@@ -496,10 +497,12 @@ class ControlReducerImpl {
         TRACE(("  IfTrue: #%d:%s\n", use->id(), use->op()->mnemonic()));
         edge.UpdateTo(NULL);
         ReplaceNode(use, (result == kTrue) ? control : dead());
+        control = NodeProperties::GetControlInput(node);  // Could change!
       } else if (use->opcode() == IrOpcode::kIfFalse) {
         TRACE(("  IfFalse: #%d:%s\n", use->id(), use->op()->mnemonic()));
         edge.UpdateTo(NULL);
         ReplaceNode(use, (result == kTrue) ? dead() : control);
+        control = NodeProperties::GetControlInput(node);  // Could change!
       }
     }
     return control;

test/mjsunit/regress/regress-447526.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar() {
+  throw "done";
+}
+
+function foo() {
+  var i;
+  while (i) {
+    while (i) {
+}
+    i++;
+  }
+  while (true) {
+    bar();
+  }
+}
+
+
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo);