[runtime] Treat empty property cells properly when doing Object.freeze() on a global object.

BUG=chromium:663750, chromium:664123

Review-Url: https://codereview.chromium.org/2495563002
Cr-Commit-Position: refs/heads/master@{#40902}

src/objects.cc

@@ -8004,6 +8004,7 @@ void DictionaryDetailsAtPut<GlobalDictionary>(
   Object* value = dictionary->ValueAt(entry);
   DCHECK(value->IsPropertyCell());
   value = PropertyCell::cast(value)->value();
+  if (value->IsTheHole(isolate)) return;
   PropertyCell::PrepareForValue(dictionary, entry, handle(value, isolate),
                                 details);
 }

test/mjsunit/regress/regress-crbug-663750.js

@@ -8,6 +8,8 @@ var v = 0;
 function foo(a) {
   v = a;
 }
+this.x = 0;
+delete x;
 
 foo(1);
 foo(2);