[turbofan] Fix control reducer with re-reducing branches.

R=jarin@chromium.org
LOG=Y
BUG=chromium:458876

Review URL: https://codereview.chromium.org/917383004

Cr-Commit-Position: refs/heads/master@{#26666}

src/compiler/control-reducer.cc

@@ -400,6 +400,8 @@ class ControlReducerImpl {
 
     // Reduce branches, phis, and merges.
     switch (node->opcode()) {
+      case IrOpcode::kBranch:
+        return ReduceBranch(node);
       case IrOpcode::kIfTrue:
         return ReduceIfTrue(node);
       case IrOpcode::kIfFalse:
@@ -478,6 +480,14 @@ class ControlReducerImpl {
     return replacement == NULL ? dead() : replacement;
   }
 
+  // Reduce branches.
+  Node* ReduceBranch(Node* branch) {
+    if (DecideCondition(branch->InputAt(0)) != kUnknown) {
+      for (Node* use : branch->uses()) Revisit(use);
+    }
+    return branch;
+  }
+
   // Reduce merges by trimming away dead inputs from the merge and phis.
   Node* ReduceMerge(Node* node) {
     // Count the number of live inputs.

src/compiler/graph-visualizer.cc

@@ -800,7 +800,7 @@ std::ostream& operator<<(std::ostream& os, const AsRPO& ar) {
     if (pop) {
       state[n->id()] = kVisited;
       stack.pop();
-      os << "#" << SafeId(n) << ":" << SafeMnemonic(n) << "(";
+      os << "#" << n->id() << ":" << *n->op() << "(";
       int j = 0;
       for (Node* const i : n->inputs()) {
         if (j++ > 0) os << ", ";

test/mjsunit/regress/regress-458876.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function module() {
+    "use asm";
+    function foo() {
+      do ; while (foo ? 0 : 1) ;
+      return -1 > 0 ? -1 : 0;
+    }
+    return foo;
+}
+
+var foo = module();
+assertEquals(0, foo());
+assertEquals(0, foo());