[turbofan] Use reference equal to zero instead of a smi check.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 924 matching lines @@
   // Perform checks whether the fast mode applies, by looking for any extension
   // object which might shadow the optimistic declaration.
   uint32_t bitset = access.check_bitset();
   Node* check_true = control;
   Node* check_false = graph()->NewNode(common()->Merge(0));
   for (int depth = 0; bitset != 0; bitset >>= 1, depth++) {
     if ((bitset & 1) == 0) continue;
     Node* load = graph()->NewNode(
         javascript()->LoadContext(depth, Context::EXTENSION_INDEX, false),
         context, context, effect);
-    Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), load);
+    Node* check = graph()->NewNode(simplified()->ReferenceEqual(Type::Tagged()),
+                                   load, jsgraph()->ZeroConstant());
     Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue), check,
                                     check_true);
     Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
     Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
     check_false->set_op(common()->Merge(check_false->InputCount() + 1));
     check_false->AppendInput(graph()->zone(), if_false);
     check_true = if_true;
   }
 
   // Fast case, because variable is not shadowed. Perform global object load.
@@ skipping 584 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8