[turbofan] Fix merging of empty and non-empty state in load elimination.

Unfortunately, I was unable to produce a repro without asm.js. In normal
JavaScript, the bounds check renaming saves us.

I have not done anything about the index variable aliasing and handling
of differently sized elements yet!

BUG=chromium:639210, v8:5266

Review-Url: https://codereview.chromium.org/2270793004
Cr-Commit-Position: refs/heads/master@{#38874}

src/compiler/load-elimination.cc

@@ -219,9 +219,7 @@ void LoadElimination::AbstractState::Merge(AbstractState const* that,
   if (this->elements_) {
     this->elements_ = that->elements_
                           ? that->elements_->Merge(this->elements_, zone)
-                          : that->elements_;
-  } else {
-    this->elements_ = that->elements_;
+                          : nullptr;
   }
 
   // Merge the information we have about the fields.

test/mjsunit/compiler/regress-639210.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var m = (function m() {
+  "use asm"
+  var i32 = new Int32Array(4);
+  var f64 = new Float64Array(4);
+
+  function init() {
+    i32[0] = 1;
+    f64[0] = 0.1;
+  }
+
+  function load(b) {
+    return (b ? 0 : i32[0]) + i32[0];
+  }
+
+  function store(b) {
+    if (b|0) {
+    } else {
+      f64[0] = 42;
+    }
+    return f64[0];
+  }
+
+  return { init : init, load : load, store : store };
+})();
+
+m.init();
+
+%OptimizeFunctionOnNextCall(m.load);
+assertEquals(2, m.load());
+
+%OptimizeFunctionOnNextCall(m.store);
+assertEquals(0.1, m.store(1));