[turbofan] Remove bogus DCHECK and add a comment

Bug: chromium:1062916
Change-Id: Ic29ca849fb17c1409cc11018fdbc9d3363ebd55c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2110027
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66801}

src/compiler/constant-folding-reducer.cc

@@ -43,18 +43,16 @@ Node* TryGetConstant(JSGraph* jsgraph, Node* node) {
 bool IsAlreadyBeingFolded(Node* node) {
   DCHECK(FLAG_assert_types);
   if (node->opcode() == IrOpcode::kFoldConstant) return true;
-  bool found = false;
   for (Edge edge : node->use_edges()) {
-    if (!NodeProperties::IsValueEdge(edge)) continue;
-    if (edge.from()->opcode() == IrOpcode::kFoldConstant) {
-      DCHECK(!found);
-      found = true;
-#ifndef ENABLE_SLOW_DCHECKS
-      break;
-#endif
+    if (NodeProperties::IsValueEdge(edge) &&
+        edge.from()->opcode() == IrOpcode::kFoldConstant) {
+      // Note: {node} may have gained new value uses since the time it was
+      // "constant-folded", and theses uses should ideally be rewritten as well.
+      // For simplicity, we ignore them here.
+      return true;
     }
   }
-  return found;
+  return false;
 }
 }  // namespace
 

test/mjsunit/compiler/regress-1062916.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-analyze-environment-liveness --no-use-ic
+
+function foo(x) {
+  var a = [];
+  for (var k1 in x) {
+    for (var k2 in x) {
+      a.k2;
+    }
+  }
+  return a.join();
+}
+
+%PrepareFunctionForOptimization(foo);
+foo({p: 42});
+%OptimizeFunctionOnNextCall(foo);
+foo();