[turbofan] escape analysis: no longer remove TypeGuard nodes

The analysis phase used to skip TypeGuard nodes, which are
normally re-introduced by the reduction phase. However, phi nodes
are created during the analysis phase already, and so it could happen
that a phi input skips a TypeGuard.

This CL solves the problem by not removing TypeGuard nodes in the first
place, but only forwarding the VirtualObject. This is analogous to how
we already treat FinishRegion nodes, which are similar in that they are
a renaming too.

Bug: chromium:741225
Change-Id: Icf8aa2d40a30d89788d875b37b9986111f9c966f
Reviewed-on: https://chromium-review.googlesource.com/958442
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51863}

src/compiler/escape-analysis.cc

@@ -623,9 +623,7 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
       break;
     }
     case IrOpcode::kTypeGuard: {
-      // The type-guard is re-introduced in the final reducer if the types
-      // don't match.
-      current->SetReplacement(current->ValueInput(0));
+      current->SetVirtualObject(current->ValueInput(0));
       break;
     }
     case IrOpcode::kReferenceEqual: {

test/mjsunit/compiler/escape-analysis-18.js

@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function bar(arr) {
+    var x = 0;
+    arr.forEach(function(el) {
+        x = el;
+    });
+    return x;
+}
+
+function foo(array) {
+    return bar(array);
+}
+
+let array = [,.5,];
+foo(array);
+foo(array);
+%OptimizeFunctionOnNextCall(foo);
+foo(array);