[turbofan] Reducers should revisit end after merging to it.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 400 matching lines @@
   Node* exit_control =
       (exit_control_count == 1)
           ? exit_controls.front()
           : graph()->NewNode(common()->Merge(exit_control_count),
                              exit_control_count, &exit_controls.front());
   Node* deoptimize =
       graph()->NewNode(common()->Deoptimize(DeoptimizeKind::kEager),
                        frame_state, exit_effect, exit_control);
   // TODO(bmeurer): This should be on the AdvancedReducer somehow.
   NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
+  Revisit(graph()->end());
 
   // Generate the final merge point for all (polymorphic) branches.
   int const control_count = static_cast<int>(controls.size());
   if (control_count == 0) {
     value = effect = control = jsgraph()->Dead();
   } else if (control_count == 1) {
     value = values.front();
     effect = effects.front();
     control = controls.front();
   } else {
@@ skipping 412 matching lines @@
   Node* exit_control =
       (exit_control_count == 1)
           ? exit_controls.front()
           : graph()->NewNode(common()->Merge(exit_control_count),
                              exit_control_count, &exit_controls.front());
   Node* deoptimize =
       graph()->NewNode(common()->Deoptimize(DeoptimizeKind::kEager),
                        frame_state, exit_effect, exit_control);
   // TODO(bmeurer): This should be on the AdvancedReducer somehow.
   NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
+  Revisit(graph()->end());
 
   // Generate the final merge point for all (polymorphic) branches.
   int const control_count = static_cast<int>(controls.size());
   if (control_count == 0) {
     value = effect = control = jsgraph()->Dead();
   } else if (control_count == 1) {
     value = values.front();
     effect = effects.front();
     control = controls.front();
   } else {
@@ skipping 161 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8