[turbofan]: Integrate basic type feedback for property accesses.

src/compiler/js-intrinsic-lowering.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-intrinsic-lowering.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties.h"
 
@@ skipping 65 matching lines @@
   Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
   NodeProperties::ReplaceWithValue(node, jsgraph()->UndefinedConstant(), effect,
                                    if_false);
 
   // True branch: deopt.
   Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
   Node* deopt =
       graph()->NewNode(common()->Deoptimize(), frame_state, effect, if_true);
 
   // Connect the deopt to the merge exiting the graph.
-  Node* end_pred = NodeProperties::GetControlInput(graph()->end());
-  if (end_pred->opcode() == IrOpcode::kMerge) {
-    int inputs = end_pred->op()->ControlInputCount() + 1;
-    end_pred->AppendInput(graph()->zone(), deopt);
-    end_pred->set_op(common()->Merge(inputs));
-  } else {
-    Node* merge = graph()->NewNode(common()->Merge(2), end_pred, deopt);
-    NodeProperties::ReplaceControlInput(graph()->end(), merge);
-  }
+  NodeProperties::MergeControlToEnd(graph(), common(), deopt);
 
   return Changed(deopt);
 }
 
 
 Reduction JSIntrinsicLowering::ReduceInlineIsSmi(Node* node) {
   return Change(node, simplified()->ObjectIsSmi());
 }
 
 
@@ skipping 188 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSIntrinsicLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8