[turbofan] Fix liveness analysis for let variable in TDZ.

This makes sure that initializing assignments of let-declared variables
perform an environment lookup and hence keep the variable alive. This is
needed because full-codegen contains debug code verifying the variable
is still inside the TDZ at the initializing assignment.

R=jarin@chromium.org
TEST=mjsunit/compiler/regress-variable-liveness-let
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1420573002

Cr-Commit-Position: refs/heads/master@{#31437}

src/compiler/ast-graph-builder.cc

@@ -3498,13 +3498,19 @@ Node* AstGraphBuilder::BuildVariableAssignment(
           return BuildThrowConstAssignError(bailout_id);
         }
         return value;
+      } else if (mode == LET && op == Token::INIT_LET) {
+        // No initialization check needed because scoping guarantees it. Note
+        // that we still perform a lookup to keep the variable live, because
+        // baseline code might contain debug code that inspects the variable.
+        Node* current = environment()->Lookup(variable);
+        CHECK_NOT_NULL(current);
       } else if (mode == LET && op != Token::INIT_LET) {
         // Perform an initialization check for let declared variables.
         Node* current = environment()->Lookup(variable);
         if (current->op() == the_hole->op()) {
-          value = BuildThrowReferenceError(variable, bailout_id);
+          return BuildThrowReferenceError(variable, bailout_id);
         } else if (current->opcode() == IrOpcode::kPhi) {
-          value = BuildHoleCheckThenThrow(current, variable, value, bailout_id);
+          BuildHoleCheckThenThrow(current, variable, value, bailout_id);
         }
       } else if (mode == CONST && op == Token::INIT_CONST) {
         // Perform an initialization check for const {this} variables.

test/mjsunit/compiler/regress-variable-liveness-let.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=f
+
+"use strict";
+
+function f() {
+  %DeoptimizeNow();
+  let x = 23;
+}
+
+%OptimizeFunctionOnNextCall(f);
+f();

test/mjsunit/mjsunit.status

@@ -154,7 +154,6 @@
 
   # Issue 4493: Bugs due to --turbo-inlining.
   'sparse-array-reverse': [PASS, NO_VARIANTS],
-  'harmony/reflect': [PASS, NO_VARIANTS],
 
   # Assumptions about optimization need investigation in TurboFan.
   'compiler/inlined-call': [PASS, NO_VARIANTS],