[compiler] Revisit graph end after a gasm reduction in call reducer

The graph assembler calls MergeControlToEnd as part of Unreachable
node creation; this causes issues when used inside the GraphReducer
framework, since the reducer is not notified by gasm that the end node
should be revisited.

The (hacky) fix in this CL is to always mark the end node for
revisitation after a gasm reduction has taken place.

Bug: v8:8888,chromium:1123379
Change-Id: I350bb7144add04a0c3fd7f3d88c07fcfe1cd42e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2384772
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69619}

src/compiler/js-call-reducer.cc

@@ -2230,6 +2230,15 @@ Reduction JSCallReducer::ReplaceWithSubgraph(JSCallReducerAssembler* gasm,
                      handler_effect, handler_control);
   }
 
+  // TODO(jgruber): This is a hack around the issue described at crbug/1123379,
+  // i.e.: MergeControlToEnd, used by GraphAssembler::Unreachable, currently
+  // doesn't interact well when used inside a compiler phase based on the
+  // GraphReducer framework. What happens is that control is merged to the
+  // graph end, but the reducer is not notified and does not know to revisit
+  // the end node. We thus do this manually here. A proper fix would be to add
+  // support either inside GraphAssembler, or in a GraphAssembler wrapper.
+  Revisit(graph()->end());
+
   return Replace(subgraph);
 }
 

test/mjsunit/regress/regress-1123379.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --noanalyze-environment-liveness --interrupt-budget=1000
+
+for (let __v_1 = 0; __v_1 < 5000; __v_1++) {
+  try {
+    [].reduce(function () {});
+  } catch (__v_2) {}
+}
+
+__v_5 = {
+  get: function () {
+  }
+};