[turbofan] Track multiple maps for LoadElimination.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 979 matching lines @@
           field_access.write_barrier_kind = kNoWriteBarrier;
           break;
         }
         case MachineRepresentation::kTaggedPointer: {
           // Ensure that {value} is a HeapObject.
           value = effect = graph()->NewNode(simplified()->CheckHeapObject(),
                                             value, effect, control);
           Handle<Map> field_map;
           if (access_info.field_map().ToHandle(&field_map)) {
             // Emit a map check for the value.
-            effect = graph()->NewNode(simplified()->CheckMaps(1), value,
-                                      jsgraph()->HeapConstant(field_map),
-                                      effect, control);
+            effect = graph()->NewNode(
+                simplified()->CheckMaps(ZoneHandleSet<Map>(field_map)), value,
+                effect, control);
           }
           field_access.write_barrier_kind = kPointerWriteBarrier;
           break;
         }
         case MachineRepresentation::kTagged:
           break;
         case MachineRepresentation::kNone:
         case MachineRepresentation::kBit:
         case MachineRepresentation::kWord8:
         case MachineRepresentation::kWord16:
@@ skipping 54 matching lines @@
 
   // Load the elements for the {receiver}.
   Node* elements = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
       effect, control);
 
   // Don't try to store to a copy-on-write backing store.
   if (access_mode == AccessMode::kStore &&
       IsFastSmiOrObjectElementsKind(elements_kind) &&
       store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
-    effect =
-        graph()->NewNode(simplified()->CheckMaps(1), elements,
-                         jsgraph()->FixedArrayMapConstant(), effect, control);
+    effect = graph()->NewNode(simplified()->CheckMaps(ZoneHandleSet<Map>(
+                                  factory()->fixed_array_map())),
+                              elements, effect, control);
   }
 
   if (IsFixedTypedArrayElementsKind(elements_kind)) {
     // Load the {receiver}s length.
     Node* length = effect = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForJSTypedArrayLength()),
         receiver, effect, control);
 
     // Check if the {receiver}s buffer was neutered.
     Node* buffer = effect = graph()->NewNode(
@@ skipping 206 matching lines @@
       effect = graph()->NewNode(simplified()->StoreElement(element_access),
                                 elements, index, value, effect, control);
     }
   }
 
   return ValueEffectControl(value, effect, control);
 }
 
 Node* JSNativeContextSpecialization::BuildCheckMaps(
     Node* receiver, Node* effect, Node* control,
-    std::vector<Handle<Map>> const& maps) {
+    std::vector<Handle<Map>> const& receiver_maps) {
   HeapObjectMatcher m(receiver);
   if (m.HasValue()) {
     Handle<Map> receiver_map(m.Value()->map(), isolate());
     if (receiver_map->is_stable()) {
-      for (Handle<Map> map : maps) {
+      for (Handle<Map> map : receiver_maps) {
         if (map.is_identical_to(receiver_map)) {
           dependencies()->AssumeMapStable(receiver_map);
           return effect;
         }
       }
     }
   }
-  int const map_input_count = static_cast<int>(maps.size());
-  int const input_count = 1 + map_input_count + 1 + 1;
-  Node** inputs = zone()->NewArray<Node*>(input_count);
-  inputs[0] = receiver;
-  for (int i = 0; i < map_input_count; ++i) {
-    inputs[1 + i] = jsgraph()->HeapConstant(maps[i]);
+  // TODO(turbofan): This could be more efficient.
+  ZoneHandleSet<Map> maps;
+  for (Handle<Map> map : receiver_maps) {
+    maps.insert(map, graph()->zone());
   }
-  inputs[input_count - 2] = effect;
-  inputs[input_count - 1] = control;
-  return graph()->NewNode(simplified()->CheckMaps(map_input_count), input_count,
-                          inputs);
+  return graph()->NewNode(simplified()->CheckMaps(maps), receiver, effect,
+                          control);
 }
 
 Node* JSNativeContextSpecialization::BuildCheckHeapObject(Node* receiver,
                                                           Node* effect,
                                                           Node* control) {
   switch (receiver->opcode()) {
     case IrOpcode::kHeapConstant:
     case IrOpcode::kJSCreate:
     case IrOpcode::kJSCreateArguments:
     case IrOpcode::kJSCreateArray:
@@ skipping 189 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8