[Turbofan] Wire loads into the effect chain

In call reductions for Array.prototype.map and forEach, loads weren't
wired appropriately into the effect chain, hampering the efficacy of
load elimination.

Bug: 
Change-Id: If5a386b66669d7173d5cadc6d8d3ff023daed810
Reviewed-on: https://chromium-review.googlesource.com/707073Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48376}

src/compiler/js-call-reducer.cc

@@ -653,7 +653,7 @@ Reduction JSCallReducer::ReduceArrayForEach(Handle<JSFunction> function,
 
   Node* k = jsgraph()->ZeroConstant();
 
-  Node* original_length = graph()->NewNode(
+  Node* original_length = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForJSArrayLength(PACKED_ELEMENTS)),
       receiver, effect, control);
 
@@ -712,7 +712,7 @@ Reduction JSCallReducer::ReduceArrayForEach(Handle<JSFunction> function,
 
   // Make sure that the access is still in bounds, since the callback could have
   // changed the array's size.
-  Node* length = graph()->NewNode(
+  Node* length = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForJSArrayLength(PACKED_ELEMENTS)),
       receiver, effect, control);
   k = effect =
@@ -721,11 +721,11 @@ Reduction JSCallReducer::ReduceArrayForEach(Handle<JSFunction> function,
   // Reload the elements pointer before calling the callback, since the previous
   // callback might have resized the array causing the elements buffer to be
   // re-allocated.
-  Node* elements = graph()->NewNode(
+  Node* elements = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
       effect, control);
 
-  Node* element = graph()->NewNode(
+  Node* element = effect = graph()->NewNode(
       simplified()->LoadElement(AccessBuilder::ForFixedArrayElement(kind)),
       elements, k, effect, control);
 
@@ -876,7 +876,7 @@ Reduction JSCallReducer::ReduceArrayMap(Handle<JSFunction> function,
       simplified()->CheckMaps(CheckMapsFlag::kNone, receiver_maps), receiver,
       effect, control);
 
-  Node* original_length = graph()->NewNode(
+  Node* original_length = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForJSArrayLength(PACKED_ELEMENTS)),
       receiver, effect, control);
 
@@ -943,7 +943,7 @@ Reduction JSCallReducer::ReduceArrayMap(Handle<JSFunction> function,
 
   // Make sure that the access is still in bounds, since the callback could have
   // changed the array's size.
-  Node* length = graph()->NewNode(
+  Node* length = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForJSArrayLength(kind)), receiver,
       effect, control);
   k = effect =
@@ -952,11 +952,11 @@ Reduction JSCallReducer::ReduceArrayMap(Handle<JSFunction> function,
   // Reload the elements pointer before calling the callback, since the previous
   // callback might have resized the array causing the elements buffer to be
   // re-allocated.
-  Node* elements = graph()->NewNode(
+  Node* elements = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
       effect, control);
 
-  Node* element = graph()->NewNode(
+  Node* element = effect = graph()->NewNode(
       simplified()->LoadElement(AccessBuilder::ForFixedArrayElement(kind)),
       elements, k, effect, control);