[turbofan] Track multiple maps for LoadElimination.

src/compiler/js-inlining.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-inlining.h"
 
 #include "src/ast/ast.h"
 #include "src/compilation-info.h"
 #include "src/compiler.h"
 #include "src/compiler/all-nodes.h"
@@ skipping 289 matching lines @@
 //
 //   SmallMapSet NodeProperties::CollectMapWitness(receiver, effect)
 //
 // function, which either returns the map set from the CheckMaps or
 // a singleton set from a StoreField.
 bool NeedsConvertReceiver(Node* receiver, Node* effect) {
   for (Node* dominator = effect;;) {
     if (dominator->opcode() == IrOpcode::kCheckMaps &&
         IsSame(dominator->InputAt(0), receiver)) {
       // Check if all maps have the given {instance_type}.
-      for (int i = 1; i < dominator->op()->ValueInputCount(); ++i) {
-        HeapObjectMatcher m(NodeProperties::GetValueInput(dominator, i));
-        if (!m.HasValue()) return true;
-        Handle<Map> const map = Handle<Map>::cast(m.Value());
-        if (!map->IsJSReceiverMap()) return true;
+      ZoneHandleSet<Map> const& maps =
+          CheckMapsParametersOf(dominator->op()).maps();
+      for (size_t i = 0; i < maps.size(); ++i) {
+        if (!maps[i]->IsJSReceiverMap()) return true;
       }
       return false;
     }
     switch (dominator->opcode()) {
       case IrOpcode::kStoreField: {
         FieldAccess const& access = FieldAccessOf(dominator->op());
         if (access.base_is_tagged == kTaggedBase &&
             access.offset == HeapObject::kMapOffset) {
           return true;
         }
@@ skipping 345 matching lines @@
 
 CommonOperatorBuilder* JSInliner::common() const { return jsgraph()->common(); }
 
 SimplifiedOperatorBuilder* JSInliner::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8