[turbofan] Fix control reducer for degenerate cases of self-loop branches.

src/compiler/control-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/common-operator.h"
 #include "src/compiler/control-reducer.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-marker.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 264 matching lines @@
   void ReduceTop() {
     size_t height = stack_.size();
     Node* node = stack_.back();
 
     if (node->IsDead()) return Pop();  // Node was killed while on stack.
 
     TRACE(("ControlReduce: #%d:%s\n", node->id(), node->op()->mnemonic()));
 
     // Recurse on an input if necessary.
     for (Node* const input : node->inputs()) {
+      CHECK_NE(NULL, input);
       if (Recurse(input)) return;
     }
 
     // All inputs should be visited or on stack. Apply reductions to node.
     Node* replacement = ReduceNode(node);
     if (replacement != node) ReplaceNode(node, replacement);
 
     // After reducing the node, pop it off the stack.
     CHECK_EQ(static_cast<int>(height), static_cast<int>(stack_.size()));
     Pop();
@@ skipping 194 matching lines @@
            (result == kTrue) ? "true" : "false"));
 
     // Replace IfTrue and IfFalse projections from this branch.
     Node* control = NodeProperties::GetControlInput(node);
     for (Edge edge : node->use_edges()) {
       Node* use = edge.from();
       if (use->opcode() == IrOpcode::kIfTrue) {
         TRACE(("  IfTrue: #%d:%s\n", use->id(), use->op()->mnemonic()));
         edge.UpdateTo(NULL);
         ReplaceNode(use, (result == kTrue) ? control : dead());
+        control = NodeProperties::GetControlInput(node);  // Could change!
       } else if (use->opcode() == IrOpcode::kIfFalse) {
         TRACE(("  IfFalse: #%d:%s\n", use->id(), use->op()->mnemonic()));
         edge.UpdateTo(NULL);
         ReplaceNode(use, (result == kTrue) ? dead() : control);
+        control = NodeProperties::GetControlInput(node);  // Could change!
       }
     }
     return control;
   }
 
   // Remove inputs to {node} corresponding to the dead inputs to {merge}
   // and compact the remaining inputs, updating the operator.
   void RemoveDeadInputs(Node* merge, Node* node) {
     int pos = 0;
     for (int i = 0; i < node->InputCount(); i++) {
@@ skipping 71 matching lines @@
 Node* ControlReducer::ReduceBranchForTesting(JSGraph* jsgraph,
                                              CommonOperatorBuilder* common,
                                              Node* node) {
   Zone zone(jsgraph->graph()->zone()->isolate());
   ControlReducerImpl impl(&zone, jsgraph, common);
   return impl.ReduceBranch(node);
 }
 }
 }
 }  // namespace v8::internal::compiler