[turbofan] Kill transition-kind source map in load elimination.

Bug: chromium:799263
Change-Id: I656d6b621234f2f0a7f379866a114b8cb66eca25
Reviewed-on: https://chromium-review.googlesource.com/852072Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50379}

src/compiler/load-elimination.cc

@@ -863,6 +863,8 @@ Reduction LoadElimination::ReduceTransitionElementsKind(Node* node) {
     if (object_maps.contains(ZoneHandleSet<Map>(source_map))) {
       object_maps.remove(source_map, zone());
       object_maps.insert(target_map, zone());
+      AliasStateInfo alias_info(state, object, source_map);
+      state = state->KillMaps(alias_info, zone());
       state = state->SetMaps(object, object_maps, zone());
     }
   } else {
@@ -887,6 +889,7 @@ Reduction LoadElimination::ReduceTransitionAndStoreElement(Node* node) {
   if (state->LookupMaps(object, &object_maps)) {
     object_maps.insert(double_map, zone());
     object_maps.insert(fast_map, zone());
+    state = state->KillMaps(object, zone());
     state = state->SetMaps(object, object_maps, zone());
   }
   // Kill the elements as well.

test/mjsunit/compiler/regress-799263.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(a, b) {
+  b[0] = 0;
+
+  a.length;
+
+  // TransitionElementsKind
+  for (let i = 0; i < 1; i++)
+      a[0] = 0;
+
+  b[0] = 9.431092e-317;
+}
+
+let arr1 = new Array(1);
+arr1[0] = 'a';
+opt(arr1, [0]);
+
+let arr2 = [0.1];
+opt(arr2, arr2);
+
+%OptimizeFunctionOnNextCall(opt);
+
+opt(arr2, arr2);
+assertEquals(9.431092e-317, arr2[0]);