[turbofan] Properly type field access to stable heap object maps.

src/compiler/pipeline.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/pipeline.h"
 
 #include <fstream>  // NOLINT(readability/streams)
 #include <sstream>
 
 #include "src/base/adapters.h"
@@ skipping 1079 matching lines @@
   RunPrintAndVerify("Early trimmed", true);
 
   if (FLAG_print_turbo_replay) {
     // Print a replay of the initial graph.
     GraphReplayPrinter::PrintReplay(data.graph());
   }
 
   base::SmartPointer<Typer> typer;
   if (info()->is_typing_enabled()) {
     // Type the graph.
-    typer.Reset(new Typer(isolate(), data.graph(), info()->function_type()));
+    typer.Reset(new Typer(isolate(), data.graph(),
+                          info()->is_deoptimization_enabled()
+                              ? Typer::kDeoptimizationEnabled
+                              : Typer::kNoFlags,
+                          info()->dependencies(), info()->function_type()));
     Run<TyperPhase>(typer.get());
     RunPrintAndVerify("Typed");
   }
 
   BeginPhaseKind("lowering");
 
   if (info()->is_typing_enabled()) {
     // Lower JSOperators where we can determine types.
     Run<TypedLoweringPhase>();
     RunPrintAndVerify("Lowered typed");
@@ skipping 304 matching lines @@
     tcf << AsC1VRegisterAllocationData("CodeGen",
                                        data->register_allocation_data());
   }
 
   data->DeleteRegisterAllocationZone();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8