[turbofan] Fix deferred replacement in simplified lowering.

Deferred replacement must also replace in the pending node vector.

BUG=chromium:463056
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/966423002

Cr-Commit-Position: refs/heads/master@{#26938}

src/compiler/simplified-lowering.cc

@@ -124,6 +124,11 @@ class RepresentationSelector {
       Node* node = *i;
       Node* replacement = *(++i);
       node->ReplaceUses(replacement);
+      // We also need to replace the node in the rest of the vector.
+      for (NodeVector::iterator j = i + 1; j != replacements_.end(); ++j) {
+        ++j;
+        if (*j == node) *j = replacement;
+      }
     }
   }
 

test/mjsunit/compiler/regress-463056.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ return ((0%0)&1) + (1>>>(0%0));
+}
+
+f();