[turbofan] Properly type field access to stable heap object maps.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 91 matching lines @@
     dependencies()->AssumePropertyCell(property_cell);
     // Compute proper type based on the current value in the cell.
     Type* property_cell_value_type;
     if (property_cell_value->IsSmi()) {
       property_cell_value_type = Type::Intersect(
           Type::SignedSmall(), Type::TaggedSigned(), graph()->zone());
     } else if (property_cell_value->IsNumber()) {
       property_cell_value_type = Type::Intersect(
           Type::Number(), Type::TaggedPointer(), graph()->zone());
     } else {
-      property_cell_value_type = Type::Of(property_cell_value, graph()->zone());
+      Handle<Map> property_cell_value_map(
+          Handle<HeapObject>::cast(property_cell_value)->map(), isolate());
+      property_cell_value_type =
+          Type::Class(property_cell_value_map, graph()->zone());
     }
     Node* value = effect = graph()->NewNode(
         simplified()->LoadField(
             AccessBuilder::ForPropertyCellValue(property_cell_value_type)),
         jsgraph()->Constant(property_cell), effect, control);
     return Replace(node, value, effect);
   }
 
   // Load from non-configurable, data property on the global can be lowered to
   // a field load, even without deoptimization, because the property cannot be
@@ skipping 275 matching lines @@
             if (access_mode == kStore) {
               // Store is not safe if the field type was cleared.
               break;
             }
 
             // The field type was cleared by the GC, so we don't know anything
             // about the contents now.
             // TODO(bmeurer): It would be awesome to make this saner in the
             // runtime/GC interaction.
             field_type = Type::TaggedPointer();
-          } else {
+          } else if (!Type::Any()->Is(field_type)) {
             // Add proper code dependencies in case of stable field map(s).
-            if (field_type->NumClasses() > 0 && field_type->NowStable()) {
-              dependencies()->AssumeFieldType(
-                  handle(map->FindFieldOwner(number), isolate()));
-              for (auto i = field_type->Classes(); !i.Done(); i.Advance()) {
-                dependencies()->AssumeMapStable(i.Current());
-              }
-            } else {
-              field_type = Type::TaggedPointer();
-            }
+            Handle<Map> field_owner_map(map->FindFieldOwner(number), isolate());
+            dependencies()->AssumeFieldType(field_owner_map);
           }
           DCHECK(field_type->Is(Type::TaggedPointer()));
         }
         *access_info = PropertyAccessInfo::DataField(receiver_type, field_index,
                                                      field_type, holder);
         return true;
       } else {
         // TODO(bmeurer): Add support for accessors.
         break;
       }
@@ skipping 511 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8