[turbofan] Broaden checkpoint elimination on returns.

This makes the elimination of checkpoints flowing effect-wise into nodes
having the {Return} operator more permissive. We can cut out checkpoints
even when they are not wholly owned by the return. This also alleviates
a problem where TCO no longer applies.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-624747
BUG=chromium:624747

Review-Url: https://codereview.chromium.org/2118793002
Cr-Commit-Position: refs/heads/master@{#37480}

src/compiler/checkpoint-elimination.cc

@@ -41,9 +41,9 @@ Reduction CheckpointElimination::ReduceCheckpoint(Node* node) {
 Reduction CheckpointElimination::ReduceReturn(Node* node) {
   DCHECK_EQ(IrOpcode::kReturn, node->opcode());
   Node* effect = NodeProperties::GetEffectInput(node);
-  if (effect->opcode() == IrOpcode::kCheckpoint && effect->OwnedBy(node)) {
-    // Any checkpoint that is wholly owned by a {Return} node can never be used
-    // for an actual bailout and can hence be cut out of the effect chain.
+  if (effect->opcode() == IrOpcode::kCheckpoint) {
+    // Any {Return} node can never be used to insert a deoptimization point,
+    // hence checkpoints can be cut out of the effect chain flowing into it.
     Node* replacement = NodeProperties::GetEffectInput(effect);
     NodeProperties::ReplaceEffectInput(node, replacement);
     return Changed(node);

test/mjsunit/regress/regress-crbug-624747.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --es-staging
+
+"use strict";
+
+function bar() {
+  try {
+    unref;
+  } catch (e) {
+    return (1 instanceof TypeError) && unref();  // Call in tail position!
+  }
+}
+
+function foo() {
+  return bar();  // Call in tail position!
+}
+
+%OptimizeFunctionOnNextCall(foo);
+foo();