[turbofan] constructor inlining registers new nodes with the GraphReducer

Bug: chromium:723802
Change-Id: I8f23d016a5aaf785fcd27cd139a196a148a37069
Reviewed-on: https://chromium-review.googlesource.com/508712
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45424}

src/compiler/graph-reducer.cc

@@ -244,8 +244,6 @@ void GraphReducer::ReplaceWithValue(Node* node, Node* value, Node* effect,
         DCHECK_NOT_NULL(control);
         edge.UpdateTo(control);
         Revisit(user);
-        // TODO(jarin) Check that the node cannot throw (otherwise, it
-        // would have to be connected via IfSuccess/IfException).
       }
     } else if (NodeProperties::IsEffectEdge(edge)) {
       DCHECK_NOT_NULL(effect);

src/compiler/js-inlining.cc

@@ -687,9 +687,8 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
         result =
             graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
                              create, node, merge);
-        NodeProperties::ReplaceUses(node_success, node_success, node_success,
-                                    merge);
-        // Fix input destroyed by the above {ReplaceUses} call.
+        ReplaceWithValue(node_success, node_success, node_success, merge);
+        // Fix input destroyed by the above {ReplaceWithValue} call.
         NodeProperties::ReplaceControlInput(branch_is_undefined, node_success,
                                             0);
       } else {
@@ -702,7 +701,7 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
                              check, node, create);
       }
       receiver = create;  // The implicit receiver.
-      NodeProperties::ReplaceUses(dummy, result);
+      ReplaceWithValue(dummy, result);
     } else if (IsDerivedConstructor(shared_info->kind())) {
       Node* node_success =
           NodeProperties::FindSuccessfulControlProjection(node);
@@ -726,9 +725,9 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
       NodeProperties::MergeControlToEnd(graph(), common(),
                                         branch_is_receiver_false);
 
-      NodeProperties::ReplaceUses(node_success, node_success, node_success,
-                                  branch_is_receiver_true);
-      // Fix input destroyed by the above {ReplaceUses} call.
+      ReplaceWithValue(node_success, node_success, node_success,
+                       branch_is_receiver_true);
+      // Fix input destroyed by the above {ReplaceWithValue} call.
       NodeProperties::ReplaceControlInput(branch_is_receiver, node_success, 0);
     }
     node->ReplaceInput(1, receiver);