[turbofan] Add a Simplified::CheckMaps instruction.

src/compiler/js-type-feedback.cc

Index: src/compiler/js-type-feedback.cc
diff --git a/src/compiler/js-type-feedback.cc b/src/compiler/js-type-feedback.cc
index 689e4aca58e2e6be22026ff820295b2527c76a46..5b5a0d4c70557eb99e80ee05ae41abc5c3fef635 100644
--- a/src/compiler/js-type-feedback.cc
+++ b/src/compiler/js-type-feedback.cc
@@ -196,8 +196,6 @@ Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamed(Node* node) {
     oracle()->KeyedPropertyReceiverTypes(slot, &maps, &is_string, &key_type);
   }
 
-  Node* effect = NodeProperties::GetEffectInput(node);
-
   if (maps.length() != 1) return NoChange();  // TODO(turbofan): polymorphism
   if (!ENABLE_FAST_PROPERTY_LOADS) return NoChange();
 
@@ -207,21 +205,17 @@ Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamed(Node* node) {
     return NoChange();
   }
 
+  Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  Node* check_success;
-  Node* check_failed;
-  BuildMapCheck(receiver, map, true, effect, control, &check_success,
-                &check_failed);
-
+  Node* map_const = jsgraph()->Constant(map);
+  Node* map_check =
+      graph()->NewNode(simplified()->CheckMaps(1), receiver, map_const,
+                       frame_state_before, effect, control);
   // Build the actual load.
   Node* load = graph()->NewNode(simplified()->LoadField(field_access), receiver,
-                                effect, check_success);
+                                effect, map_check);
 
-  // TODO(turbofan): handle slow case instead of deoptimizing.
-  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state_before,
-                                 effect, check_failed);
-  NodeProperties::MergeControlToEnd(graph(), common(), deopt);
-  ReplaceWithValue(node, load, load, check_success);
+  ReplaceWithValue(node, load, load, map_check);
   return Replace(load);
 }
 
@@ -323,9 +317,6 @@ Reduction JSTypeFeedbackSpecializer::ReduceJSStoreNamed(Node* node) {
     }
   }
 
-  Node* receiver = node->InputAt(0);
-  Node* effect = NodeProperties::GetEffectInput(node);
-
   if (maps.length() != 1) return NoChange();  // TODO(turbofan): polymorphism
 
   if (!ENABLE_FAST_PROPERTY_STORES) return NoChange();
@@ -336,22 +327,18 @@ Reduction JSTypeFeedbackSpecializer::ReduceJSStoreNamed(Node* node) {
     return NoChange();
   }
 
+  Node* receiver = node->InputAt(0);
+  Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  Node* check_success;
-  Node* check_failed;
-  BuildMapCheck(receiver, map, true, effect, control, &check_success,
-                &check_failed);
-
-  // Build the actual load.
+  Node* map_const = jsgraph()->Constant(map);
+  Node* map_check =
+      graph()->NewNode(simplified()->CheckMaps(1), receiver, map_const,
+                       frame_state_before, effect, control);
+  // Build the actual store.
   Node* value = node->InputAt(1);
   Node* store = graph()->NewNode(simplified()->StoreField(field_access),
-                                 receiver, value, effect, check_success);
-
-  // TODO(turbofan): handle slow case instead of deoptimizing.
-  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state_before,
-                                 effect, check_failed);
-  NodeProperties::MergeControlToEnd(graph(), common(), deopt);
-  ReplaceWithValue(node, store, store, check_success);
+                                 receiver, value, effect, map_check);
+  ReplaceWithValue(node, store, store, map_check);
   return Replace(store);
 }
 
@@ -361,36 +348,6 @@ Reduction JSTypeFeedbackSpecializer::ReduceJSStoreProperty(Node* node) {
 }
 
 
-void JSTypeFeedbackSpecializer::BuildMapCheck(Node* receiver, Handle<Map> map,
-                                              bool smi_check, Node* effect,
-                                              Node* control, Node** success,
-                                              Node** fail) {
-  Node* if_smi = nullptr;
-  if (smi_check) {
-    Node* branch_smi = graph()->NewNode(
-        common()->Branch(BranchHint::kFalse),
-        graph()->NewNode(simplified()->ObjectIsSmi(), receiver), control);
-    if_smi = graph()->NewNode(common()->IfTrue(), branch_smi);
-    control = graph()->NewNode(common()->IfFalse(), branch_smi);
-  }
-
-  FieldAccess map_access = AccessBuilder::ForMap();
-  Node* receiver_map = graph()->NewNode(simplified()->LoadField(map_access),
-                                        receiver, effect, control);
-  Node* map_const = jsgraph_->Constant(map);
-  Node* cmp = graph()->NewNode(simplified()->ReferenceEqual(Type::Internal()),
-                               receiver_map, map_const);
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kTrue), cmp, control);
-  *success = graph()->NewNode(common()->IfTrue(), branch);
-  *fail = graph()->NewNode(common()->IfFalse(), branch);
-
-  if (if_smi) {
-    *fail = graph()->NewNode(common()->Merge(2), *fail, if_smi);
-  }
-}
-
-
 // Get the frame state before an operation if it exists and has a valid
 // bailout id.
 Node* JSTypeFeedbackSpecializer::GetFrameStateBefore(Node* node) {