[turbofan] Properly rename receiver on CheckHeapObject.

src/compiler/js-call-reducer.cc

Index: src/compiler/js-call-reducer.cc
diff --git a/src/compiler/js-call-reducer.cc b/src/compiler/js-call-reducer.cc
index 4ed123723efcd4dce79e805327fbc70bc182f47b..e48fce91c4dac3f17d0944ae7dd05b3bc64f4c63 100644
--- a/src/compiler/js-call-reducer.cc
+++ b/src/compiler/js-call-reducer.cc
@@ -191,6 +191,19 @@ Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
 
 namespace {
 
+// TODO(turbofan): Shall we move this to the NodeProperties? Or some (untyped)
+// alias analyzer?
+bool IsSame(Node* a, Node* b) {
+  if (a == b) {
+    return true;
+  } else if (a->opcode() == IrOpcode::kCheckHeapObject) {
+    return IsSame(a->InputAt(0), b);
+  } else if (b->opcode() == IrOpcode::kCheckHeapObject) {
+    return IsSame(a, b->InputAt(0));
+  }
+  return false;
+}
+
 // TODO(turbofan): Share with similar functionality in JSInliningHeuristic
 // and JSNativeContextSpecialization, i.e. move to NodeProperties helper?!
 MaybeHandle<Map> InferReceiverMap(Node* node) {
@@ -200,7 +213,7 @@ MaybeHandle<Map> InferReceiverMap(Node* node) {
   // for the {receiver}, and if so use that map for the lowering below.
   for (Node* dominator = effect;;) {
     if (dominator->opcode() == IrOpcode::kCheckMaps &&
-        dominator->InputAt(0) == receiver) {
+        IsSame(dominator->InputAt(0), receiver)) {
       if (dominator->op()->ValueInputCount() == 2) {
         HeapObjectMatcher m(dominator->InputAt(1));
         if (m.HasValue()) return Handle<Map>::cast(m.Value());