[turbofan] Check index type for potential element aliasing.

src/compiler/load-elimination.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/load-elimination.h"
 
 #include "src/compiler/common-operator.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
@@ skipping 198 matching lines @@
                                         Zone* zone) const {
   for (Element const element : this->elements_) {
     if (element.object == nullptr) continue;
     if (MayAlias(object, element.object)) {
       AbstractElements* that = new (zone) AbstractElements(zone);
       for (Element const element : this->elements_) {
         if (element.object == nullptr) continue;
         DCHECK_NOT_NULL(element.index);
         DCHECK_NOT_NULL(element.value);
         if (!MayAlias(object, element.object) ||
-            !MayAlias(index, element.index)) {
+            !NodeProperties::GetType(index)->Maybe(
+                NodeProperties::GetType(element.index))) {
           that->elements_[that->next_index_++] = element;
         }
       }
       that->next_index_ %= arraysize(elements_);
       return that;
     }
   }
   return this;
 }
 
@@ skipping 668 matching lines @@
 
 CommonOperatorBuilder* LoadElimination::common() const {
   return jsgraph()->common();
 }
 
 Graph* LoadElimination::graph() const { return jsgraph()->graph(); }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8