[turbofan] Always use the map write barrier when storing to the map field.

src/compiler/change-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/change-lowering.h"
 
 #include "src/address-map.h"
 #include "src/code-factory.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
@@ skipping 447 matching lines @@
         input_type->Is(Type::TaggedPointer())) {
       // Write barriers for heap objects don't need a Smi check.
       return kPointerWriteBarrier;
     }
     // Write barriers are only for writes into heap objects (i.e. tagged base).
     return kFullWriteBarrier;
   }
   return kNoWriteBarrier;
 }
 
+
+WriteBarrierKind ComputeWriteBarrierKind(BaseTaggedness base_is_tagged,
+                                         MachineRepresentation representation,
+                                         int field_offset, Type* field_type,
+                                         Type* input_type) {
+  if (base_is_tagged == kTaggedBase && field_offset == HeapObject::kMapOffset) {
+    // Write barriers for storing maps are cheaper.
+    return kMapWriteBarrier;
+  }
+  return ComputeWriteBarrierKind(base_is_tagged, representation, field_type,
+                                 input_type);
+}
+
 }  // namespace
 
 
 Reduction ChangeLowering::LoadField(Node* node) {
   const FieldAccess& access = FieldAccessOf(node->op());
   Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
   node->InsertInput(graph()->zone(), 1, offset);
   NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
   return Changed(node);
 }
 
 
 Reduction ChangeLowering::StoreField(Node* node) {
   const FieldAccess& access = FieldAccessOf(node->op());
   Type* type = NodeProperties::GetType(node->InputAt(1));
   WriteBarrierKind kind = ComputeWriteBarrierKind(
-      access.base_is_tagged, access.machine_type.representation(), access.type,
-      type);
+      access.base_is_tagged, access.machine_type.representation(),
+      access.offset, access.type, type);
   Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
   node->InsertInput(graph()->zone(), 1, offset);
   NodeProperties::ChangeOp(node,
                            machine()->Store(StoreRepresentation(
                                access.machine_type.representation(), kind)));
   return Changed(node);
 }
 
 
 Node* ChangeLowering::ComputeIndex(const ElementAccess& access,
@@ skipping 85 matching lines @@
 }
 
 
 MachineOperatorBuilder* ChangeLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8