Fix try-finally for dead AST-branches in TurboFan.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-455644
BUG=chromium:455644
LOG=N

Review URL: https://codereview.chromium.org/880443004

Cr-Commit-Position: refs/heads/master@{#26458}

src/compiler/ast-graph-builder.cc

@@ -1194,7 +1194,6 @@ void AstGraphBuilder::VisitTryCatchStatement(TryCatchStatement* stmt) {
 
   // Create a catch scope that binds the exception.
   Node* exception = try_control.GetExceptionNode();
-  if (exception == NULL) exception = jsgraph()->NullConstant();
   Unique<String> name = MakeUnique(stmt->variable()->name());
   const Operator* op = javascript()->CreateCatchContext(name);
   Node* context = NewNode(op, exception, GetFunctionClosure());

src/compiler/ast-graph-builder.h

@@ -55,6 +55,7 @@ class AstGraphBuilder : public AstVisitor {
 
   // Get the node that represents the outer function context.
   Node* GetFunctionContext();
+
   // Get the node that represents the outer function closure.
   Node* GetFunctionClosure();
 

src/compiler/control-builders.cc

@@ -151,7 +151,7 @@ void BlockBuilder::EndBlock() {
 
 void TryCatchBuilder::BeginTry() {
   catch_environment_ = environment()->CopyAsUnreachable();
-  catch_environment_->Push(nullptr);
+  catch_environment_->Push(the_hole());
 }
 
 
@@ -178,7 +178,7 @@ void TryCatchBuilder::EndCatch() {
 
 void TryFinallyBuilder::BeginTry() {
   finally_environment_ = environment()->CopyAsUnreachable();
-  finally_environment_->Push(nullptr);
+  finally_environment_->Push(the_hole());
 }
 
 

src/compiler/control-builders.h

@@ -32,6 +32,7 @@ class ControlBuilder {
   Zone* zone() const { return builder_->local_zone(); }
   Environment* environment() { return builder_->environment(); }
   void set_environment(Environment* env) { builder_->set_environment(env); }
+  Node* the_hole() const { return builder_->jsgraph()->TheHoleConstant(); }
 
   Builder* builder_;
 };

test/mjsunit/regress/regress-crbug-455644.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function f() {
+  do { return 23; } while(false);
+  with (0) {
+    try {
+      return 42;
+    } finally {}
+  }
+})();