[turbofan] Make sure an inlined call is not resurrected and inlined again.

BUG=chromium:714483

Review-Url: https://codereview.chromium.org/2833423004
Cr-Commit-Position: refs/heads/master@{#44830}

src/compiler/js-inlining-heuristic.cc

@@ -270,6 +270,9 @@ Reduction JSInliningHeuristic::InlineCandidate(Candidate const& candidate) {
     Node* node = calls[i];
     Reduction const reduction = inliner_.ReduceJSCall(node);
     if (reduction.Changed()) {
+      // Killing the call node is not strictly necessary, but it is safer to
+      // make sure we do not resurrect the node.
+      node->Kill();
       cumulative_count_ += function->shared()->ast_node_count();
     }
   }

src/compiler/js-inlining.cc

@@ -218,7 +218,8 @@ Reduction JSInliner::InlineCall(Node* call, Node* new_target, Node* context,
     ReplaceWithValue(call, value_output, effect_output, control_output);
     return Changed(value_output);
   } else {
-    ReplaceWithValue(call, call, call, jsgraph()->Dead());
+    ReplaceWithValue(call, jsgraph()->Dead(), jsgraph()->Dead(),
+                     jsgraph()->Dead());
     return Changed(call);
   }
 }

test/mjsunit/compiler/regress-714483.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function C1() { }
+C1.prototype.f = function () { return 1; }
+
+function C2() { }
+C2.prototype.f = function () { throw 2; }
+
+var o1 = new C1();
+var o2 = new C2();
+
+function foo(o) {
+  return o.f();
+}
+
+foo(o1);
+try { foo(o2); } catch(e) {}
+foo(o1);
+try { foo(o2); } catch(e) {}
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo(o1));
+assertThrows(() => foo(o2));