Revert "[turbofan] Avoid raw InferReceiverMaps in JSCallReducer"

This reverts commit 9284ad5731.

Reason for revert: breaks blink tests:
https://ci.chromium.org/p/v8/builders/ci/V8-Blink%20Win/16839

Original change's description:
> [turbofan] Avoid raw InferReceiverMaps in JSCallReducer
> 
> Instead provide an abstraction that makes it hard to forget
> dealing with unreliable maps.
> 
> This also fixes a deopt loop in Function.prototype.bind and
> one in Array.prototype.reduce.
> 
> Bug: v8:9137
> Change-Id: If6a51182c8693a62e9fb6d302cec19b4d48e25cb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578501
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61106}

TBR=jarin@chromium.org,neis@chromium.org

Change-Id: I97e0f47fb82eda76656905a3f7cc494babd92be6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9137
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588433
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61118}

src/compiler/js-call-reducer.h

@@ -190,6 +190,11 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
 
   Reduction ReduceNumberConstructor(Node* node);
 
+  Node* InsertMapChecksIfUnreliableReceiverMaps(
+      NodeProperties::InferReceiverMapsResult result,
+      ZoneHandleSet<Map> const& receiver_maps, VectorSlotPair const& feedback,
+      Node* receiver, Node* effect, Node* control);
+
   // Returns the updated {to} node, and updates control and effect along the
   // way.
   Node* DoFilterPostCallbackWork(ElementsKind kind, Node** control,

src/isolate.h

@@ -1168,13 +1168,7 @@ class Isolate final : private HiddenFactory {
   inline bool IsArraySpeciesLookupChainIntact();
   inline bool IsTypedArraySpeciesLookupChainIntact();
   inline bool IsRegExpSpeciesLookupChainIntact();
-
-  // Check that the @@species protector is intact, which guards the lookup of
-  // "constructor" on JSPromise instances, whose [[Prototype]] is the initial
-  // %PromisePrototype%, and the Symbol.species lookup on the
-  // %PromisePrototype%.
   inline bool IsPromiseSpeciesLookupChainIntact();
-
   bool IsIsConcatSpreadableLookupChainIntact();
   bool IsIsConcatSpreadableLookupChainIntact(JSReceiver receiver);
   inline bool IsStringLengthOverflowIntact();
@@ -1220,7 +1214,7 @@ class Isolate final : private HiddenFactory {
   inline bool IsArrayBufferDetachingIntact();
 
   // Disable promise optimizations if promise (debug) hooks have ever been
-  // active, because those can observe promises.
+  // active.
   bool IsPromiseHookProtectorIntact();
 
   // Make sure a lookup of "resolve" on the %Promise% intrinsic object

test/mjsunit/compiler/regress-9137-1.js

@@ -1,24 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --opt
-// Flags: --no-flush-bytecode --no-stress-flush-bytecode
-
-function changeMap(obj) {
-  obj.blub = 42;
-}
-
-function foo(obj) {
-  return obj.bind(changeMap(obj));
-}
-
-%NeverOptimizeFunction(changeMap);
-%PrepareFunctionForOptimization(foo);
-foo(function(){});
-foo(function(){});
-%OptimizeFunctionOnNextCall(foo);
-foo(function(){});
-%OptimizeFunctionOnNextCall(foo);
-foo(function(){});
-assertOptimized(foo);

test/mjsunit/compiler/regress-9137-2.js

@@ -1,28 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --opt
-// Flags: --no-flush-bytecode --no-stress-flush-bytecode
-
-function changeMap(obj) {
-  obj.blub = 42;
-}
-
-function reducer(acc, val, i, obj) {
-  return changeMap(obj);
-}
-
-function foo(obj) {
-  return obj.reduce(reducer);
-}
-
-%NeverOptimizeFunction(reducer);
-%PrepareFunctionForOptimization(foo);
-foo([0, 1, 2]);
-foo([0, 1, 2]);
-%OptimizeFunctionOnNextCall(foo);
-foo([0, 1, 2]);
-%OptimizeFunctionOnNextCall(foo);
-foo([0, 1, 2]);
-assertOptimized(foo);