[turbofan] handle killed branches in branch-elimination

Bug: chromium:814084
Change-Id: Ic23091e1cd778b09406c2bcde1a718e464655729
Reviewed-on: https://chromium-review.googlesource.com/939386Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51600}

src/compiler/branch-elimination.cc

@@ -62,7 +62,9 @@ Reduction BranchElimination::ReduceBranch(Node* node) {
   // If we know the condition we can discard the branch.
   if (from_input.LookupCondition(condition, &branch, &condition_value)) {
     // Mark the branch as a safety check.
-    if (IsSafetyCheckOf(node->op()) == IsSafetyCheck::kSafetyCheck) {
+    // Check if {branch} is dead because we might have a stale side-table entry.
+    if (IsSafetyCheckOf(node->op()) == IsSafetyCheck::kSafetyCheck &&
+        !branch->IsDead()) {
       NodeProperties::ChangeOp(branch,
                                common()->MarkAsSafetyCheck(branch->op()));
     }