[turbofan] Fix effect chain for polymorphic array access.

We accidently dropped the effect on the floor that we have for the
polymorphic map check in case of array elements access.

BUG=chromium:655004
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2411273002
Cr-Commit-Position: refs/heads/master@{#40201}

src/compiler/js-native-context-specialization.cc

@@ -604,7 +604,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
                                               fallthrough_control);
               this_controls.push_back(
                   graph()->NewNode(common()->IfTrue(), branch));
-              this_effects.push_back(effect);
+              this_effects.push_back(this_effect);
               fallthrough_control =
                   graph()->NewNode(common()->IfFalse(), branch);
             }

test/mjsunit/regress/regress-crbug-655004.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+  a.x = 0;
+  if (a.x === 0) a[1] = 0.1;
+  a.x = {};
+}
+foo(new Array(1));
+foo(new Array(1));
+%OptimizeFunctionOnNextCall(foo);
+foo(new Array(1));