[turbofan] Track multiple maps for LoadElimination.

src/compiler/js-builtin-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 95 matching lines @@
 namespace {
 
 MaybeHandle<Map> GetMapWitness(Node* node) {
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   // Check if the {node} is dominated by a CheckMaps with a single map
   // for the {receiver}, and if so use that map for the lowering below.
   for (Node* dominator = effect;;) {
     if (dominator->opcode() == IrOpcode::kCheckMaps &&
         dominator->InputAt(0) == receiver) {
-      if (dominator->op()->ValueInputCount() == 2) {
-        HeapObjectMatcher m(dominator->InputAt(1));
-        if (m.HasValue()) return Handle<Map>::cast(m.Value());
-      }
-      return MaybeHandle<Map>();
+      ZoneHandleSet<Map> const& maps =
+          CheckMapsParametersOf(dominator->op()).maps();
+      return (maps.size() == 1) ? MaybeHandle<Map>(maps[0])
+                                : MaybeHandle<Map>();
     }
     if (dominator->op()->EffectInputCount() != 1) {
       // Didn't find any appropriate CheckMaps node.
       return MaybeHandle<Map>();
     }
     dominator = NodeProperties::GetEffectInput(dominator);
   }
 }
 
 // TODO(turbofan): This was copied from Crankshaft, might be too restrictive.
@@ skipping 188 matching lines @@
   return NoChange();
 }
 
 namespace {
 
 bool HasInstanceTypeWitness(Node* receiver, Node* effect,
                             InstanceType instance_type) {
   for (Node* dominator = effect;;) {
     if (dominator->opcode() == IrOpcode::kCheckMaps &&
         dominator->InputAt(0) == receiver) {
+      ZoneHandleSet<Map> const& maps =
+          CheckMapsParametersOf(dominator->op()).maps();
       // Check if all maps have the given {instance_type}.
-      for (int i = 1; i < dominator->op()->ValueInputCount(); ++i) {
-        Node* const map = NodeProperties::GetValueInput(dominator, i);
-        Type* const map_type = NodeProperties::GetType(map);
-        if (!map_type->IsConstant()) return false;
-        Handle<Map> const map_value =
-            Handle<Map>::cast(map_type->AsConstant()->Value());
-        if (map_value->instance_type() != instance_type) return false;
+      for (size_t i = 0; i < maps.size(); ++i) {
+        if (maps[i]->instance_type() != instance_type) return false;
       }
       return true;
     }
     switch (dominator->opcode()) {
       case IrOpcode::kStoreField: {
         FieldAccess const& access = FieldAccessOf(dominator->op());
         if (access.base_is_tagged == kTaggedBase &&
             access.offset == HeapObject::kMapOffset) {
           return false;
         }
@@ skipping 903 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSBuiltinReducer::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8