[turbofan] Fix FinishRegion handling in NodeProperties::InferReceiverMaps.

src/compiler/node-properties.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/node-properties.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 386 matching lines @@
         }
         break;
       }
       case IrOpcode::kJSStoreMessage:
       case IrOpcode::kJSStoreModule:
       case IrOpcode::kStoreElement:
       case IrOpcode::kStoreTypedElement: {
         // These never change the map of objects.
         break;
       }
+      case IrOpcode::kFinishRegion: {
+        // FinishRegion renames the output of allocations, so we need
+        // to update the {receiver} that we are looking for, if the
+        // {receiver} matches the current {effect}.
+        if (IsSame(receiver, effect)) receiver = GetValueInput(effect, 0);
+        break;
+      }
       default: {
         DCHECK_EQ(1, effect->op()->EffectOutputCount());
         if (effect->op()->EffectInputCount() != 1) {
           // Didn't find any appropriate CheckMaps node.
           return kNoReceiverMaps;
         }
         if (!effect->op()->HasProperty(Operator::kNoWrite)) {
           // Without alias/escape analysis we cannot tell whether this
           // {effect} affects {receiver} or not.
           result = kUnreliableReceiverMaps;
         }
         break;
       }
     }
+
+    // Stop walking the effect chain once we hit the definition of
+    // the {receiver} along the {effect}s.
+    if (IsSame(receiver, effect)) return kNoReceiverMaps;
+
+    // Continue with the next {effect}.
     DCHECK_EQ(1, effect->op()->EffectInputCount());
     effect = NodeProperties::GetEffectInput(effect);
   }
 }
 
 // static
 MaybeHandle<Context> NodeProperties::GetSpecializationContext(
     Node* node, MaybeHandle<Context> context) {
   switch (node->opcode()) {
     case IrOpcode::kHeapConstant:
@@ skipping 47 matching lines @@
 // static
 bool NodeProperties::IsInputRange(Edge edge, int first, int num) {
   if (num == 0) return false;
   int const index = edge.index();
   return first <= index && index < first + num;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8