[turbofan] Check for dead control in branch elimination.

If the branch associated with the condition is kDead, the current
node will be killed anyway, so let us just survive the lowering.

Bug: chromium:935092
Change-Id: If7b39e3b5452d6c9bc5199080eb38725e6c4eab5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1488769Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60143}

src/compiler/branch-elimination.cc

@@ -63,7 +63,7 @@ Reduction BranchElimination::ReduceBranch(Node* node) {
   if (from_input.LookupCondition(condition, &branch, &condition_value)) {
     // Mark the branch as a safety check if necessary.
     // Check if {branch} is dead because we might have a stale side-table entry.
-    if (!branch->IsDead()) {
+    if (!branch->IsDead() && branch->opcode() != IrOpcode::kDead) {
       IsSafetyCheck branch_safety = IsSafetyCheckOf(branch->op());
       IsSafetyCheck combined_safety =
           CombineSafetyChecks(branch_safety, IsSafetyCheckOf(node->op()));

test/mjsunit/compiler/regress-935092.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(g) {
+    for (var X = 0; X < 1; X++) {
+        (new(function() {
+            this.y
+        })).x;
+        (g || (g && (((g || -N)(g && 0))))).y = 0
+    }
+    (function() { g })
+}
+opt({});
+%OptimizeFunctionOnNextCall(opt);
+opt({});