[turbofan] Fix constructor inlining control wiring.

src/compiler/js-inlining.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-inlining.h"
 
 #include "src/ast/ast-numbering.h"
 #include "src/ast/ast.h"
 #include "src/ast/scopes.h"
 #include "src/compiler.h"
@@ skipping 416 matching lines @@
     Node* receiver = jsgraph()->UndefinedConstant();  // Implicit receiver.
     if (NeedsImplicitReceiver(shared_info)) {
       Node* frame_state_before = NodeProperties::FindFrameStateBefore(node);
       Node* effect = NodeProperties::GetEffectInput(node);
       Node* context = NodeProperties::GetContextInput(node);
       Node* create = graph()->NewNode(javascript()->Create(), call.target(),
                                       call.new_target(), context,
                                       frame_state_before, effect);
       NodeProperties::ReplaceEffectInput(node, create);
       // Insert a check of the return value to determine whether the return
-      // value
-      // or the implicit receiver should be selected as a result of the call.
+      // value or the implicit receiver should be selected as a result of the
+      // call. The check is wired into the successful control completion.
+      Node* success = graph()->NewNode(common()->IfSuccess(), node);
       Node* check = graph()->NewNode(
           javascript()->CallRuntime(Runtime::kInlineIsJSReceiver, 1), node,
-          context, node, start);
+          context, node, success);
       Node* select =
           graph()->NewNode(common()->Select(MachineRepresentation::kTagged),
                            check, node, create);
-      NodeProperties::ReplaceUses(node, select, check, node, node);
-      NodeProperties::ReplaceValueInput(select, node, 1);
-      NodeProperties::ReplaceValueInput(check, node, 0);
-      NodeProperties::ReplaceEffectInput(check, node);
+      NodeProperties::ReplaceUses(node, select, check, check, node);
+      // Fix-up inputs that have been mangled by the {ReplaceUses} call above.
+      NodeProperties::ReplaceValueInput(select, node, 1);  // Fix-up input.
+      NodeProperties::ReplaceValueInput(check, node, 0);   // Fix-up input.
+      NodeProperties::ReplaceEffectInput(check, node);     // Fix-up input.
+      NodeProperties::ReplaceControlInput(success, node);  // Fix-up input.
       receiver = create;  // The implicit receiver.
     }
 
     // Swizzle the inputs of the {JSCallConstruct} node to look like inputs to a
     // normal {JSCallFunction} node so that the rest of the inlining machinery
     // behaves as if we were dealing with a regular function invocation.
     new_target = call.new_target();  // Retrieve new target value input.
     node->RemoveInput(call.formal_arguments() + 1);  // Drop new target.
     node->InsertInput(graph()->zone(), 1, receiver);
 
@@ skipping 61 matching lines @@
 
 JSOperatorBuilder* JSInliner::javascript() const {
   return jsgraph()->javascript();
 }
 
 CommonOperatorBuilder* JSInliner::common() const { return jsgraph()->common(); }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8