[turbofan] Ensure {CheckMaps} is not used accross mutations.

src/compiler/js-builtin-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 
 #include "src/base/bits.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 103 matching lines @@
   // Check if the {node} is dominated by a CheckMaps with a single map
   // for the {receiver}, and if so use that map for the lowering below.
   for (Node* dominator = effect;;) {
     if (dominator->opcode() == IrOpcode::kCheckMaps &&
         NodeProperties::IsSame(dominator->InputAt(0), receiver)) {
       ZoneHandleSet<Map> const& maps =
           CheckMapsParametersOf(dominator->op()).maps();
       return (maps.size() == 1) ? MaybeHandle<Map>(maps[0])
                                 : MaybeHandle<Map>();
     }
-    if (dominator->op()->EffectInputCount() != 1) {
+    DCHECK_EQ(1, dominator->op()->EffectOutputCount());
+    if (dominator->op()->EffectInputCount() != 1 ||
+        !dominator->op()->HasProperty(Operator::kNoWrite)) {
       // Didn't find any appropriate CheckMaps node.
       return MaybeHandle<Map>();
     }
     dominator = NodeProperties::GetEffectInput(dominator);
   }
 }
 
 // TODO(turbofan): This was copied from Crankshaft, might be too restrictive.
 bool IsReadOnlyLengthDescriptor(Handle<Map> jsarray_map) {
   DCHECK(!jsarray_map->is_dictionary_map());
@@ skipping 2035 matching lines @@
   return jsgraph()->simplified();
 }
 
 JSOperatorBuilder* JSBuiltinReducer::javascript() const {
   return jsgraph()->javascript();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8