[turbofan] Fix constructor inlining control wiring.

src/compiler/js-inlining.cc

Index: src/compiler/js-inlining.cc
diff --git a/src/compiler/js-inlining.cc b/src/compiler/js-inlining.cc
index 00a0eed26db580a889b1e85ec5d8a3cf9474a93e..5ef5bcf34fbe5bd6d0469f1eb512b86c8210cde7 100644
--- a/src/compiler/js-inlining.cc
+++ b/src/compiler/js-inlining.cc
@@ -434,18 +434,20 @@ Reduction JSInliner::ReduceJSCall(Node* node, Handle<JSFunction> function) {
                                       frame_state_before, effect);
       NodeProperties::ReplaceEffectInput(node, create);
       // Insert a check of the return value to determine whether the return
-      // value
-      // or the implicit receiver should be selected as a result of the call.
+      // value or the implicit receiver should be selected as a result of the
+      // call. The check is wired into the successful control completion.
+      Node* success = graph()->NewNode(common()->IfSuccess(), node);
       Node* check = graph()->NewNode(
           javascript()->CallRuntime(Runtime::kInlineIsJSReceiver, 1), node,
-          context, node, start);
+          context, node, success);
       Node* select =
           graph()->NewNode(common()->Select(MachineRepresentation::kTagged),
                            check, node, create);
-      NodeProperties::ReplaceUses(node, select, check, node, node);
+      NodeProperties::ReplaceUses(node, select, check, check, node);
       NodeProperties::ReplaceValueInput(select, node, 1);
       NodeProperties::ReplaceValueInput(check, node, 0);
       NodeProperties::ReplaceEffectInput(check, node);
+      NodeProperties::ReplaceControlInput(success, node);

[Jarin, 2016/08/23 12:30:03]

Please add a comment explaining that these are fixups.

[Michael Starzinger, 2016/08/23 12:39:04]

Done.

       receiver = create;  // The implicit receiver.
     }