[turbofan] Fix constructor inlining control wiring.

This makes sure the check of the return value of an inlined constructor
call is properly wired into the control chain. The check only happens on
successful completion of the underlying call and hence is wired into the
success latch of the control projections.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2272633002
Cr-Commit-Position: refs/heads/master@{#38820}

src/compiler/js-inlining.cc

@@ -434,18 +434,21 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
                                       frame_state_before, effect);
       NodeProperties::ReplaceEffectInput(node, create);
       // Insert a check of the return value to determine whether the return
-      // value
-      // or the implicit receiver should be selected as a result of the call.
+      // value or the implicit receiver should be selected as a result of the
+      // call. The check is wired into the successful control completion.
+      Node* success = graph()->NewNode(common()->IfSuccess(), node);
       Node* check = graph()->NewNode(
           javascript()->CallRuntime(Runtime::kInlineIsJSReceiver, 1), node,
-          context, node, start);
+          context, node, success);
       Node* select =
           graph()->NewNode(common()->Select(MachineRepresentation::kTagged),
                            check, node, create);
-      NodeProperties::ReplaceUses(node, select, check, node, node);
-      NodeProperties::ReplaceValueInput(select, node, 1);
-      NodeProperties::ReplaceValueInput(check, node, 0);
-      NodeProperties::ReplaceEffectInput(check, node);
+      NodeProperties::ReplaceUses(node, select, check, check, node);
+      // Fix-up inputs that have been mangled by the {ReplaceUses} call above.
+      NodeProperties::ReplaceValueInput(select, node, 1);  // Fix-up input.
+      NodeProperties::ReplaceValueInput(check, node, 0);   // Fix-up input.
+      NodeProperties::ReplaceEffectInput(check, node);     // Fix-up input.
+      NodeProperties::ReplaceControlInput(success, node);  // Fix-up input.
       receiver = create;  // The implicit receiver.
     }