In a generator containing loops, there are always certain control flow
paths that are impossible, due to the way we represent generators at the
bytecode level.  Unfortunately, the graph builder can't tell that these
paths are impossible.  In combination with dead code, it can then happen
that we build a subgraph (for unreachable code) whose incoming context
is the undefined oddball.  JSContextSpecialization did not expect that.

Bug: chromium:794822
Change-Id: I259be5ae6c5f5adc8fca19c64bf71285ee922b7a
Reviewed-on: https://chromium-review.googlesource.com/828954Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50129}