[turbofan] Fix FinishRegion handling in NodeProperties::InferReceiverMaps.

When looking for receiver maps, we need to account for the renaming
performed by FinishRegion, and look for the original receiver instead
from that point on.

Drive-by-fix: Abort effect chain walk as soon as the definition of the
receiver is seen on the effect chain.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2836853002
Cr-Commit-Position: refs/heads/master@{#44833}

src/compiler/node-properties.cc

@@ -404,6 +404,13 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
         // These never change the map of objects.
         break;
       }
+      case IrOpcode::kFinishRegion: {
+        // FinishRegion renames the output of allocations, so we need
+        // to update the {receiver} that we are looking for, if the
+        // {receiver} matches the current {effect}.
+        if (IsSame(receiver, effect)) receiver = GetValueInput(effect, 0);
+        break;
+      }
       default: {
         DCHECK_EQ(1, effect->op()->EffectOutputCount());
         if (effect->op()->EffectInputCount() != 1) {
@@ -418,6 +425,12 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
         break;
       }
     }
+
+    // Stop walking the effect chain once we hit the definition of
+    // the {receiver} along the {effect}s.
+    if (IsSame(receiver, effect)) return kNoReceiverMaps;
+
+    // Continue with the next {effect}.
     DCHECK_EQ(1, effect->op()->EffectInputCount());
     effect = NodeProperties::GetEffectInput(effect);
   }