[turbofan] Don't try to constant-fold properties from the_hole.

Bug: chromium:772190, v8:6819, v8:6820, v8:6831
Change-Id: Ied2dc954ff7575043988087d96782cfbb99e9ec8
Reviewed-on: https://chromium-review.googlesource.com/704578Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48336}

src/compiler/js-native-context-specialization.cc

@@ -1258,7 +1258,7 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
   // Optimize the case where we load from a constant {receiver}.
   if (access_mode == AccessMode::kLoad) {
     HeapObjectMatcher mreceiver(receiver);
-    if (mreceiver.HasValue() &&
+    if (mreceiver.HasValue() && !mreceiver.Value()->IsTheHole(isolate()) &&
         !mreceiver.Value()->IsNullOrUndefined(isolate())) {
       // Check whether we're accessing a known element on the {receiver}
       // that is non-configurable, non-writable (i.e. the {receiver} was

test/mjsunit/regress/regress-772190.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+assertThrows(function() {
+  __v_13383[4];
+  let __v_13383 = {};
+});