[turbofan] Use speculation mode when optimizing collection iterator

This fixes a performance regression.

Bug: v8:9197, chromium:958730
Change-Id: I70a59dd85d74275b967a196e9ab4623293b92756
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1596446Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61241}

src/compiler/js-call-reducer.cc

@@ -6118,6 +6118,11 @@ Reduction JSCallReducer::ReduceCollectionIteratorPrototypeNext(
     InstanceType collection_iterator_instance_type_first,
     InstanceType collection_iterator_instance_type_last) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* context = NodeProperties::GetContextInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -6150,9 +6155,8 @@ Reduction JSCallReducer::ReduceCollectionIteratorPrototypeNext(
         receiver_instance_type > collection_iterator_instance_type_last) {
       return inference.NoChange();
     }
-    if (!inference.RelyOnMapsViaStability(dependencies())) {
-      return inference.NoChange();
-    }
+    inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,
+                                        control, p.feedback());
   }
 
   // Transition the JSCollectionIterator {receiver} if necessary