[turbofan] Fix typer bug in Array.p.reduce[Right]

When finding the initial element in A.p.reduce[Right], we did
exclude holes, but did not reflect this is the type, which still
included the hole. This CL inserts a TypeGuard to ensure that
Turbofan knows the initial element is never the hole.

Bug: chromium:804837
Change-Id: Ia118ddafb8e16dd5c02559fa23216c9b139dd59a
Reviewed-on: https://chromium-review.googlesource.com/880967
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50814}

src/compiler/js-call-reducer.cc

@@ -1126,6 +1126,9 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
     Node* is_hole = graph()->NewNode(common()->IfTrue(), hole_branch);
 
     WireInLoopEnd(loop, eloop, vloop, next_k, is_hole, effect);
+    // We did the hole-check, so exclude hole from the type.
+    cur = effect = graph()->NewNode(common()->TypeGuard(Type::NonInternal()),
+                                    cur, effect, control);
     k = next_k;
   }
 

test/mjsunit/regress/regress-804837.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+var __v_25662 = [, 1.8];
+function __f_6214(__v_25668) {
+     __v_25662.reduce(() => {1});
+}
+__f_6214();
+__f_6214();
+%OptimizeFunctionOnNextCall(__f_6214);
+__f_6214();