[turbofan] Ensure {CheckMaps} is not used accross mutations.

src/compiler/js-builtin-reducer.cc

Index: src/compiler/js-builtin-reducer.cc
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc
index bf72ca47302545484b5bef10b88627210a6daa63..78e5a93f3d04f14fabce015b15b7ea2314800603 100644
--- a/src/compiler/js-builtin-reducer.cc
+++ b/src/compiler/js-builtin-reducer.cc
@@ -121,7 +121,9 @@ MaybeHandle<Map> GetMapWitness(Node* node) {
       return (maps.size() == 1) ? MaybeHandle<Map>(maps[0])
                                 : MaybeHandle<Map>();
     }
-    if (dominator->op()->EffectInputCount() != 1) {
+    DCHECK_EQ(1, dominator->op()->EffectOutputCount());
+    if (dominator->op()->EffectInputCount() != 1 ||
+        !dominator->op()->HasProperty(Operator::kNoWrite)) {
       // Didn't find any appropriate CheckMaps node.
       return MaybeHandle<Map>();
     }