[turbofan] Don't merge PropertyAccessInfos with different field maps.

BUG=chromium:679378
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2634953002
Cr-Commit-Position: refs/heads/master@{#42365}

src/compiler/access-info.cc

@@ -150,6 +150,7 @@ bool PropertyAccessInfo::Merge(PropertyAccessInfo const* that) {
       // Check if we actually access the same field.
       if (this->transition_map_.address() == that->transition_map_.address() &&
           this->field_index_ == that->field_index_ &&
+          this->field_map_.address() == that->field_map_.address() &&
           this->field_type_->Is(that->field_type_) &&
           that->field_type_->Is(this->field_type_) &&
           this->field_representation_ == that->field_representation_) {

test/mjsunit/regress/regress-crbug-679378.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var x = {};
+x.__defineGetter__('0', () => 0);
+x.a = {v: 1.51};
+
+var y = {};
+y.a = {u:"OK"};
+
+function foo(o) { return o.a.u; }
+foo(y);
+foo(y);
+foo(x);
+%OptimizeFunctionOnNextCall(foo);
+%DebugPrint(foo(x));