[turbofan] Utilize maps from field type tracking to eliminate map checks.

src/compiler/js-global-object-specialization.cc

Index: src/compiler/js-global-object-specialization.cc
diff --git a/src/compiler/js-global-object-specialization.cc b/src/compiler/js-global-object-specialization.cc
index bfc424e9dc1344e754e5f2fd80b16641158924e0..cbb7ce8275e546d42ad9bf44b9bfff0abaaac603 100644
--- a/src/compiler/js-global-object-specialization.cc
+++ b/src/compiler/js-global-object-specialization.cc
@@ -49,7 +49,8 @@ Reduction JSGlobalObjectSpecialization::Reduce(Node* node) {
 namespace {
 
 FieldAccess ForPropertyCellValue(MachineRepresentation representation,
-                                 Type* type, Handle<Name> name) {
+                                 Type* type, MaybeHandle<Map> map,
+                                 Handle<Name> name) {
   WriteBarrierKind kind = kFullWriteBarrier;
   if (representation == MachineRepresentation::kTaggedSigned) {
     kind = kNoWriteBarrier;
@@ -57,8 +58,8 @@ FieldAccess ForPropertyCellValue(MachineRepresentation representation,
     kind = kPointerWriteBarrier;
   }
   MachineType r = MachineType::TypeForRepresentation(representation);
-  FieldAccess access = {kTaggedBase, PropertyCell::kValueOffset, name, type, r,
-                        kind};
+  FieldAccess access = {
+      kTaggedBase, PropertyCell::kValueOffset, name, map, type, r, kind};
   return access;
 }
 }  // namespace
@@ -115,6 +116,7 @@ Reduction JSGlobalObjectSpecialization::ReduceJSLoadGlobal(Node* node) {
   }
 
   // Load from constant type cell can benefit from type feedback.
+  MaybeHandle<Map> map;
   Type* property_cell_value_type = Type::NonInternal();
   MachineRepresentation representation = MachineRepresentation::kTagged;
   if (property_details.cell_type() == PropertyCellType::kConstantType) {
@@ -126,18 +128,24 @@ Reduction JSGlobalObjectSpecialization::ReduceJSLoadGlobal(Node* node) {
       property_cell_value_type = Type::Number();
       representation = MachineRepresentation::kTaggedPointer;
     } else {
-      // TODO(turbofan): Track the property_cell_value_map on the FieldAccess
-      // below and use it in LoadElimination to eliminate map checks.
       Handle<Map> property_cell_value_map(
           Handle<HeapObject>::cast(property_cell_value)->map(), isolate());
       property_cell_value_type = Type::For(property_cell_value_map);
       representation = MachineRepresentation::kTaggedPointer;
+
+      // We can only use the property cell value map for map check elimination
+      // if it's stable, i.e. the HeapObject wasn't mutated without the cell
+      // state being updated.
+      if (property_cell_value_map->is_stable()) {
+        dependencies()->AssumeMapStable(property_cell_value_map);
+        map = property_cell_value_map;
+      }
     }
   }
-  Node* value = effect =
-      graph()->NewNode(simplified()->LoadField(ForPropertyCellValue(
-                           representation, property_cell_value_type, name)),
-                       jsgraph()->HeapConstant(property_cell), effect, control);
+  Node* value = effect = graph()->NewNode(
+      simplified()->LoadField(ForPropertyCellValue(
+          representation, property_cell_value_type, map, name)),
+      jsgraph()->HeapConstant(property_cell), effect, control);
   ReplaceWithValue(node, value, effect, control);
   return Replace(value);
 }
@@ -218,10 +226,11 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
         property_cell_value_type = Type::SignedSmall();
         representation = MachineRepresentation::kTaggedSigned;
       }
-      effect = graph()->NewNode(
-          simplified()->StoreField(ForPropertyCellValue(
-              representation, property_cell_value_type, name)),
-          jsgraph()->HeapConstant(property_cell), value, effect, control);
+      effect = graph()->NewNode(simplified()->StoreField(ForPropertyCellValue(
+                                    representation, property_cell_value_type,
+                                    MaybeHandle<Map>(), name)),
+                                jsgraph()->HeapConstant(property_cell), value,
+                                effect, control);
       break;
     }
     case PropertyCellType::kMutable: {
@@ -230,7 +239,8 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
       dependencies()->AssumePropertyCell(property_cell);
       effect = graph()->NewNode(
           simplified()->StoreField(ForPropertyCellValue(
-              MachineRepresentation::kTagged, Type::NonInternal(), name)),
+              MachineRepresentation::kTagged, Type::NonInternal(),
+              MaybeHandle<Map>(), name)),
           jsgraph()->HeapConstant(property_cell), value, effect, control);
       break;
     }