[maglev] Only support fully monomorphic GetKeyedProperty

ElementAccessFeedback transition groups can contain multiple maps in a
transition group if feedback is polymorphic on elements kind but not
otherwise the map kind. Maglev should treat this case as polymorphic.

Bug: v8:7700
Change-Id: I779299e4cf9d1c3a30e77f7a953d057ea5a69935
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3892691
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83165}

src/maglev/maglev-graph-builder.cc

@@ -1303,6 +1303,7 @@ void MaglevGraphBuilder::VisitGetKeyedProperty() {
       const compiler::ElementAccessFeedback& element_feedback =
           processed_feedback.AsElementAccess();
       if (element_feedback.transition_groups().size() != 1) break;
+      if (element_feedback.transition_groups()[0].size() != 1) break;
       compiler::MapRef map = MakeRefAssumeMemoryFence(
           broker(), element_feedback.transition_groups()[0].front());