[turbofan] Use unreliable receiver maps for __proto__ lowering.

When optimizing calls to get Object.prototype.__proto__ in
JSCallReducer, we can also consume unreliable receiver map
information, as long as the receiver maps are stable. In
that case we also need to install proper stability dependencies.

BUG=chromium:711195,v8:5267,v8:6241
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2816993002
Cr-Commit-Position: refs/heads/master@{#44634}

src/compiler/js-call-reducer.cc

@@ -337,7 +337,7 @@ Reduction JSCallReducer::ReduceObjectPrototypeGetProto(Node* node) {
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
       NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
-  if (result == NodeProperties::kReliableReceiverMaps) {
+  if (result != NodeProperties::kNoReceiverMaps) {
     Handle<Map> candidate_map(
         receiver_maps[0]->GetPrototypeChainRootMap(isolate()));
     Handle<Object> candidate_prototype(candidate_map->prototype(), isolate());
@@ -352,6 +352,15 @@ Reduction JSCallReducer::ReduceObjectPrototypeGetProto(Node* node) {
           receiver_map->prototype() != *candidate_prototype) {
         return NoChange();
       }
+      if (result == NodeProperties::kUnreliableReceiverMaps &&
+          !receiver_map->is_stable()) {
+        return NoChange();
+      }
+    }
+    if (result == NodeProperties::kUnreliableReceiverMaps) {
+      for (size_t i = 0; i < receiver_maps.size(); ++i) {
+        dependencies()->AssumeMapStable(receiver_maps[i]);
+      }
     }
     Node* value = jsgraph()->Constant(candidate_prototype);
     ReplaceWithValue(node, value);