The contract in TurboFan is that "the hole" is never passed to "user
JavaScript", which we unfortunately still don't check strictly. Now
the inlined code for Array#forEach properly checks for "the hole",
but the type of the element Node passed to the callback function
doesn't reflect that. So introduce a proper TypeGuard here to reflect
this check.

This will also improve code generation for iteration of HOLEY arrays
better and might improve performance a bit.

Bug: v8:1956
Change-Id: Ib6b3c444b16fcf44551bda1b39f976d66b9362ab
Reviewed-on: https://chromium-review.googlesource.com/705954Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48400}