Thus far the LoadElimination didn't consider CheckHeapObject a renaming
operation and would therefore miss opportunities to eliminate redundant
loads or map checks where the input is not checked for sminess in all
cases. This kind of pattern is very common with code that results from
builtin inlining in JSCallReducer, as here we don't unconditionally
insert CheckHeapObject nodes if we can tell from the graph that the
receiver already has a certain map (by walking the effect chain
upwards).

Bug: v8:8070
Change-Id: I980f382205757a754f93a5741de1ee08b75ee070
Reviewed-on: https://chromium-review.googlesource.com/1188129Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55408}