[turbofan] Eliminate checkpoints before return in common op reducer.

This makes sure that we preserve call's tailness even if we have
introduced a loop exit between the call and the return.

BUG=chromium:628773

Review-Url: https://codereview.chromium.org/2155123002
Cr-Commit-Position: refs/heads/master@{#37832}

src/compiler/checkpoint-elimination.cc

@@ -38,25 +38,10 @@ Reduction CheckpointElimination::ReduceCheckpoint(Node* node) {
   return NoChange();
 }
 
-Reduction CheckpointElimination::ReduceReturn(Node* node) {
-  DCHECK_EQ(IrOpcode::kReturn, node->opcode());
-  Node* effect = NodeProperties::GetEffectInput(node);
-  if (effect->opcode() == IrOpcode::kCheckpoint) {
-    // Any {Return} node can never be used to insert a deoptimization point,
-    // hence checkpoints can be cut out of the effect chain flowing into it.
-    Node* replacement = NodeProperties::GetEffectInput(effect);
-    NodeProperties::ReplaceEffectInput(node, replacement);
-    return Changed(node);
-  }
-  return NoChange();
-}
-
 Reduction CheckpointElimination::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kCheckpoint:
       return ReduceCheckpoint(node);
-    case IrOpcode::kReturn:
-      return ReduceReturn(node);
     default:
       break;
   }

src/compiler/checkpoint-elimination.h

@@ -21,7 +21,6 @@ class CheckpointElimination final : public AdvancedReducer {
 
  private:
   Reduction ReduceCheckpoint(Node* node);
-  Reduction ReduceReturn(Node* node);
 };
 
 }  // namespace compiler

src/compiler/common-operator-reducer.cc

@@ -303,8 +303,16 @@ Reduction CommonOperatorReducer::ReducePhi(Node* node) {
 Reduction CommonOperatorReducer::ReduceReturn(Node* node) {
   DCHECK_EQ(IrOpcode::kReturn, node->opcode());
   Node* const value = node->InputAt(0);
-  Node* const effect = node->InputAt(1);
-  Node* const control = node->InputAt(2);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* const control = NodeProperties::GetControlInput(node);
+  bool changed = false;
+  if (effect->opcode() == IrOpcode::kCheckpoint) {
+    // Any {Return} node can never be used to insert a deoptimization point,
+    // hence checkpoints can be cut out of the effect chain flowing into it.
+    effect = NodeProperties::GetEffectInput(effect);
+    NodeProperties::ReplaceEffectInput(node, effect);
+    changed = true;
+  }
   if (value->opcode() == IrOpcode::kPhi &&
       NodeProperties::GetControlInput(value) == control &&
       effect->opcode() == IrOpcode::kEffectPhi &&
@@ -329,7 +337,7 @@ Reduction CommonOperatorReducer::ReduceReturn(Node* node) {
     Replace(control, dead());
     return Replace(dead());
   }
-  return NoChange();
+  return changed ? Changed(node) : NoChange();
 }
 
 

test/mjsunit/compiler/regress-628773.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-tailcalls
+
+"use strict";
+
+function foo() {
+  for  (var i = 0; i < 10000; i++) {
+    try {
+      for (var j = 0; j < 2; j++) {
+      }
+      throw 1;
+    } catch(e) {
+      if (typeof a == "number") return a && isNaN(b);
+    }
+  }
+}
+
+foo();