[turbofan] Check for dead node in the common operator reducer.

BUG=chromium:556543
LOG=n

Review URL: https://codereview.chromium.org/1450883003

Cr-Commit-Position: refs/heads/master@{#32025}

src/compiler/common-operator-reducer.cc

@@ -204,6 +204,8 @@ Reduction CommonOperatorReducer::ReducePhi(Node* node) {
         if_false->opcode() == IrOpcode::kIfFalse &&
         if_true->InputAt(0) == if_false->InputAt(0)) {
       Node* const branch = if_true->InputAt(0);
+      // Check that the branch is not dead already.
+      if (branch->opcode() != IrOpcode::kBranch) return NoChange();
       Node* const cond = branch->InputAt(0);
       if (cond->opcode() == IrOpcode::kFloat32LessThan) {
         Float32BinopMatcher mcond(cond);

test/mjsunit/regress/regress-556543.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  for (var __v_2 = 0; __v_2 < __v_5; ++__v_2) {
+    for (var __v_5 = 0; __v_3 < 1; ++__v_8) {
+      if (true || 0 > -6) continue;
+      for (var __v_3 = 0; __v_3 < 1; ++__v_3) {
+      }
+    }
+  }
+}
+%OptimizeFunctionOnNextCall(f);
+f();