[turbofan] Ensure nodes without kNoThrow have only IfSuccess or IfException uses.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-typed-lowering.h"
 
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 1246 matching lines @@
       simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
       loop_object_map, loop_effect, control);
   Node* is_proxy =
       graph()->NewNode(simplified()->NumberEqual(), map_instance_type,
                        jsgraph()->Constant(JS_PROXY_TYPE));
   Node* branch_is_proxy =
       graph()->NewNode(common()->Branch(BranchHint::kFalse), is_proxy, control);
   Node* if_is_proxy = graph()->NewNode(common()->IfTrue(), branch_is_proxy);
   Node* e_is_proxy = effect;
 
-  Node* runtime_has_in_proto_chain = control = graph()->NewNode(
-      common()->Merge(2), if_is_access_check_needed, if_is_proxy);
+  control = graph()->NewNode(common()->Merge(2), if_is_access_check_needed,
+                             if_is_proxy);
   effect = graph()->NewNode(common()->EffectPhi(2), e_is_access_check_needed,
                             e_is_proxy, control);
 
   // If we need an access check or the object is a Proxy, make a runtime call
   // to finish the lowering.
-  Node* bool_result_runtime_has_in_proto_chain_case = graph()->NewNode(
+  Node* runtimecall = graph()->NewNode(
       javascript()->CallRuntime(Runtime::kHasInPrototypeChain), r.left(),
       prototype, context, frame_state, effect, control);
 
+  Node* runtimecall_control =
+      graph()->NewNode(common()->IfSuccess(), runtimecall);
+
   control = graph()->NewNode(common()->IfFalse(), branch_is_proxy);
 
   Node* object_prototype = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForMapPrototype()),
       loop_object_map, loop_effect, control);
 
   // If not, check if object prototype is the null prototype.
   Node* null_proto =
       graph()->NewNode(simplified()->ReferenceEqual(), object_prototype,
                        jsgraph()->NullConstant());
@@ skipping 15 matching lines @@
   control = graph()->NewNode(common()->IfFalse(), branch_eq_proto);
 
   Node* load_object_map = effect =
       graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
                        object_prototype, effect, control);
   // Close the loop.
   loop_effect->ReplaceInput(1, effect);
   loop_object_map->ReplaceInput(1, load_object_map);
   loop->ReplaceInput(1, control);
 
-  control = graph()->NewNode(common()->Merge(3), runtime_has_in_proto_chain,
+  control = graph()->NewNode(common()->Merge(3), runtimecall_control,
                              if_eq_proto, if_null_proto);
-  effect = graph()->NewNode(common()->EffectPhi(3),
-                            bool_result_runtime_has_in_proto_chain_case,
-                            e_eq_proto, e_null_proto, control);
+  effect = graph()->NewNode(common()->EffectPhi(3), runtimecall, e_eq_proto,
+                            e_null_proto, control);
 
   Node* result = graph()->NewNode(
-      common()->Phi(MachineRepresentation::kTagged, 3),
-      bool_result_runtime_has_in_proto_chain_case, jsgraph()->TrueConstant(),
-      jsgraph()->FalseConstant(), control);
+      common()->Phi(MachineRepresentation::kTagged, 3), runtimecall,
+      jsgraph()->TrueConstant(), jsgraph()->FalseConstant(), control);
 
   if (if_is_smi != nullptr) {
     DCHECK_NOT_NULL(e_is_smi);
     control = graph()->NewNode(common()->Merge(2), if_is_smi, control);
     effect =
         graph()->NewNode(common()->EffectPhi(2), e_is_smi, effect, control);
     result = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
                               jsgraph()->FalseConstant(), result, control);
   }
 
@@ skipping 823 matching lines @@
 }
 
 
 CompilationDependencies* JSTypedLowering::dependencies() const {
   return dependencies_;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8