[turbofan] Don't eliminate unused CheckFloat64Hole.

We cannot eliminate unused CheckFloat64Hole nodes, since loading from a
holey array can have side-effects, i.e. triggering getters in the
prototype chain.

R=mvstanton@chromium.org
BUG=chromium:686737

Review-Url: https://codereview.chromium.org/2665123002
Cr-Commit-Position: refs/heads/master@{#42806}

src/compiler/simplified-lowering.cc

@@ -2555,7 +2555,6 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kCheckFloat64Hole: {
-        if (truncation.IsUnused()) return VisitUnused(node);
         CheckFloat64HoleMode mode = CheckFloat64HoleModeOf(node->op());
         ProcessInput(node, 0, UseInfo::TruncatingFloat64());
         ProcessRemainingInputs(node, 1);

test/mjsunit/regress/regress-crbug-686737.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.prototype.__defineGetter__(0, () => { throw Error() });
+var a = [,0.1];
+function foo(i) { a[i]; }
+foo(1);
+foo(1);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(() => foo(0), Error);