[turbofan] Infer receiver maps from earlier map checks.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 2160 matching lines @@
             if (!effect->op()->HasProperty(Operator::kNoWrite) ||
                 effect->op()->EffectInputCount() != 1) {
               break;
             }
             effect = NodeProperties::GetEffectInput(effect);
           }
         }
       }
     }
   }
-  // TODO(turbofan): Go hunting for CheckMaps(receiver) in the effect chain?
+  // Go hunting for a matching CheckMaps(receiver) or StoreField[Map](receiver)
+  // in the {effect} chain.
+  // TODO(turbofan): Propagate the information along the control/effect chains
+  // instead at some point to avoid this potentially inefficient hunting.
+  while (true) {
+    if (effect->opcode() == IrOpcode::kCheckMaps) {
+      ZoneHandleSet<Map> maps = CheckMapsParametersOf(effect->op()).maps();
+      if (maps.size() == 1u) {
+        Node* object = NodeProperties::GetValueInput(effect, 0);
+        if (NodeProperties::IsSame(receiver, object)) return maps[0];
+      }
+    } else if (effect->opcode() == IrOpcode::kStoreField) {
+      FieldAccess const access = FieldAccessOf(effect->op());
+      if (access.offset == HeapObject::kMapOffset) {
+        Node* object = NodeProperties::GetValueInput(effect, 0);
+        Node* value = NodeProperties::GetValueInput(effect, 1);
+        if (object == receiver) {
+          HeapObjectMatcher m(value);
+          if (m.HasValue()) return Handle<Map>::cast(m.Value());
+        }
+        break;
+      }
+    } else if (!effect->op()->HasProperty(Operator::kNoWrite) ||
+               effect->op()->EffectInputCount() != 1) {
+      break;
+    }
+    effect = NodeProperties::GetEffectInput(effect);
+  }
   return MaybeHandle<Map>();
 }
 
 MaybeHandle<Map> JSNativeContextSpecialization::InferReceiverRootMap(
     Node* receiver) {
   HeapObjectMatcher m(receiver);
   if (m.HasValue()) {
     return handle(m.Value()->map()->FindRootMap(), isolate());
   } else if (m.IsJSCreate()) {
     HeapObjectMatcher mtarget(m.InputAt(0));
@@ skipping 55 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8