[turbofan] Make backing store load eliminatable for %ArrayIteratorPrototype%.next().

Place the LoadField for the backing store of the [[IteratedObject]]
before the diamond to make it possible to eliminate this LoadField
in LoadElimination later, when used in `for..of` or destructing.

This further improves the performance of `for..of` in the micro
benchmark on the tracking bug from

  console.timeEnd: forOf, 191.726000
  console.timeEnd: traditional, 107.572000
  console.timeEnd: forOf, 137.288000
  console.timeEnd: traditional, 102.976000
  console.timeEnd: forOf, 137.506000
  console.timeEnd: traditional, 103.089000

to around

  console.timeEnd: forOf, 195.238000
  console.timeEnd: traditional, 107.078000
  console.timeEnd: forOf, 128.980000
  console.timeEnd: traditional, 103.106000
  console.timeEnd: forOf, 128.525000
  console.timeEnd: traditional, 103.072000

so roughly another ~7% improvement (with untrusted code mitigations
turned off).

Bug: v8:8070
Change-Id: I34831c503384f0cc44b95317dd84403f2ed8ecd5
Reviewed-on: https://chromium-review.googlesource.com/1188138Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55390}

src/compiler/js-call-reducer.cc

@@ -5024,6 +5024,16 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
   Node* index = effect = graph()->NewNode(simplified()->LoadField(index_access),
                                           iterator, effect, control);
 
+  // Load the elements of the {iterated_object}. While it feels
+  // counter-intuitive to place the elements pointer load before
+  // the condition below, as it might not be needed (if the {index}
+  // is out of bounds for the {iterated_object}), it's better this
+  // way as it allows the LoadElimination to eliminate redundant
+  // reloads of the elements pointer.
+  Node* elements = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
+      iterated_object, effect, control);
+
   // Load the length of the {iterated_object}. Due to the map checks we
   // already know something about the length here, which we can leverage
   // to generate Word32 operations below without additional checking.
@@ -5058,10 +5068,6 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
       DCHECK(iteration_kind == IterationKind::kEntries ||
              iteration_kind == IterationKind::kValues);
 
-      Node* elements = etrue = graph()->NewNode(
-          simplified()->LoadField(AccessBuilder::ForJSObjectElements()),
-          iterated_object, etrue, if_true);
-
       if (IsFixedTypedArrayElementsKind(elements_kind)) {
         Node* base_ptr = etrue = graph()->NewNode(
             simplified()->LoadField(