[turbofan] LoadElement should not have a control input.

src/compiler/simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/simplified-lowering.h"
 
 #include <limits>
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
@@ skipping 1061 matching lines @@
   if (fixed_offset == 0) return index;
   return graph()->NewNode(machine()->Int32Add(), index,
                           jsgraph()->Int32Constant(fixed_offset));
 }
 
 
 void SimplifiedLowering::DoLoadElement(Node* node, MachineType output_type) {
   const ElementAccess& access = ElementAccessOf(node->op());
   const Operator* op = machine()->Load(access.machine_type);
   Node* key = node->InputAt(1);
+  Node* effect = node->InputAt(3);
   Node* index = ComputeIndex(access, key);
   if (access.bounds_check == kNoBoundsCheck) {
     DCHECK_EQ(access.machine_type, output_type);
     node->set_op(op);
     node->ReplaceInput(1, index);
-    node->RemoveInput(2);
+    node->ReplaceInput(2, effect);
+    node->ReplaceInput(3, graph()->start());
   } else {
     DCHECK_EQ(kTypedArrayBoundsCheck, access.bounds_check);
 
     Node* base = node->InputAt(0);
     Node* length = node->InputAt(2);
-    Node* effect = node->InputAt(3);
-    Node* control = node->InputAt(4);
 
     Node* check = graph()->NewNode(machine()->Uint32LessThan(), key, length);
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+    Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue), check,
+                                    graph()->start());
 
     Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
     Node* load = graph()->NewNode(op, base, index, effect, if_true);
     Node* result = load;
     if (output_type & kRepTagged) {
       // TODO(turbofan): This is ugly as hell!
       SimplifiedOperatorBuilder simplified(graph()->zone());
       RepresentationChanger changer(jsgraph(), &simplified,
                                     graph()->zone()->isolate());
       result = changer.GetTaggedRepresentationFor(result, access.machine_type);
@@ skipping 126 matching lines @@
 void SimplifiedLowering::DoStringLessThanOrEqual(Node* node) {
   node->set_op(machine()->IntLessThanOrEqual());
   node->ReplaceInput(0, StringComparison(node, true));
   node->ReplaceInput(1, jsgraph()->SmiConstant(EQUAL));
 }
 
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8