[turbofan] Track multiple maps for LoadElimination.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index 6de3fa1282439b3fe556415f2385ca62429e3c1d..e8efadcd3e0580d2b102fc4cbc2ea998c20de10b 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -997,9 +997,9 @@ JSNativeContextSpecialization::BuildPropertyAccess(
           Handle<Map> field_map;
           if (access_info.field_map().ToHandle(&field_map)) {
             // Emit a map check for the value.
-            effect = graph()->NewNode(simplified()->CheckMaps(1), value,
-                                      jsgraph()->HeapConstant(field_map),
-                                      effect, control);
+            effect = graph()->NewNode(
+                simplified()->CheckMaps(ZoneHandleSet<Map>(field_map)), value,
+                effect, control);
           }
           field_access.write_barrier_kind = kPointerWriteBarrier;
           break;
@@ -1074,9 +1074,9 @@ JSNativeContextSpecialization::BuildElementAccess(
   if (access_mode == AccessMode::kStore &&
       IsFastSmiOrObjectElementsKind(elements_kind) &&
       store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
-    effect =
-        graph()->NewNode(simplified()->CheckMaps(1), elements,
-                         jsgraph()->FixedArrayMapConstant(), effect, control);
+    effect = graph()->NewNode(simplified()->CheckMaps(ZoneHandleSet<Map>(
+                                  factory()->fixed_array_map())),
+                              elements, effect, control);
   }
 
   if (IsFixedTypedArrayElementsKind(elements_kind)) {
@@ -1303,12 +1303,12 @@ JSNativeContextSpecialization::BuildElementAccess(
 
 Node* JSNativeContextSpecialization::BuildCheckMaps(
     Node* receiver, Node* effect, Node* control,
-    std::vector<Handle<Map>> const& maps) {
+    std::vector<Handle<Map>> const& receiver_maps) {
   HeapObjectMatcher m(receiver);
   if (m.HasValue()) {
     Handle<Map> receiver_map(m.Value()->map(), isolate());
     if (receiver_map->is_stable()) {
-      for (Handle<Map> map : maps) {
+      for (Handle<Map> map : receiver_maps) {
         if (map.is_identical_to(receiver_map)) {
           dependencies()->AssumeMapStable(receiver_map);
           return effect;
@@ -1316,17 +1316,13 @@ Node* JSNativeContextSpecialization::BuildCheckMaps(
       }
     }
   }
-  int const map_input_count = static_cast<int>(maps.size());
-  int const input_count = 1 + map_input_count + 1 + 1;
-  Node** inputs = zone()->NewArray<Node*>(input_count);
-  inputs[0] = receiver;
-  for (int i = 0; i < map_input_count; ++i) {
-    inputs[1 + i] = jsgraph()->HeapConstant(maps[i]);
+  // TODO(turbofan): This could be more efficient.
+  ZoneHandleSet<Map> maps;
+  for (Handle<Map> map : receiver_maps) {
+    maps.insert(map, graph()->zone());
   }
-  inputs[input_count - 2] = effect;
-  inputs[input_count - 1] = control;
-  return graph()->NewNode(simplified()->CheckMaps(map_input_count), input_count,
-                          inputs);
+  return graph()->NewNode(simplified()->CheckMaps(maps), receiver, effect,
+                          control);
 }
 
 Node* JSNativeContextSpecialization::BuildCheckHeapObject(Node* receiver,