Revert "[compiler] Don't infer receiver maps for stores."

This reverts commit c94dcb21.

Reason for revert: several performances regressions.

Original change's description:
> [compiler] Don't infer receiver maps for stores.
> 
> This avoids a deopt loop.
> 
> Bug: v8:7254
> Change-Id: I9ab1dfc754c5ad63c451a9e2276aa1d7eb4c27b1
> Reviewed-on: https://chromium-review.googlesource.com/966065
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51994}

TBR=jarin@chromium.org,neis@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7254
Change-Id: Iff9c6fb61a559e48ad11d2db9e559de61cc0f5ef
Reviewed-on: https://chromium-review.googlesource.com/968302Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52012}

src/compiler/js-native-context-specialization.cc

@@ -1040,8 +1040,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccessFromNexus(
 
   // Extract receiver maps from the IC using the {nexus}.
   MapHandles receiver_maps;
-  if (!ExtractReceiverMaps(receiver, effect, nexus, access_mode,
-                           &receiver_maps)) {
+  if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
     return NoChange();
   } else if (receiver_maps.empty()) {
     if (flags() & kBailoutOnUninitialized) {
@@ -1441,8 +1440,7 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
 
   // Extract receiver maps from the {nexus}.
   MapHandles receiver_maps;
-  if (!ExtractReceiverMaps(receiver, effect, nexus, access_mode,
-                           &receiver_maps)) {
+  if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
     return NoChange();
   } else if (receiver_maps.empty()) {
     if (flags() & kBailoutOnUninitialized) {
@@ -2110,7 +2108,6 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreInArrayLiteral(
   Node* const index = NodeProperties::GetValueInput(node, 1);
   Node* const value = NodeProperties::GetValueInput(node, 2);
   Node* const effect = NodeProperties::GetEffectInput(node);
-  AccessMode access_mode = AccessMode::kStoreInLiteral;
 
   // Extract receiver maps from the keyed store IC using the FeedbackNexus.
   if (!p.feedback().IsValid()) return NoChange();
@@ -2121,8 +2118,7 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreInArrayLiteral(
 
   // Extract receiver maps from the {nexus}.
   MapHandles receiver_maps;
-  if (!ExtractReceiverMaps(receiver, effect, nexus, access_mode,
-                           &receiver_maps)) {
+  if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
     return NoChange();
   } else if (receiver_maps.empty()) {
     if (flags() & kBailoutOnUninitialized) {
@@ -2138,8 +2134,9 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreInArrayLiteral(
   if (nexus.ic_state() == MEGAMORPHIC) return NoChange();
 
   // Try to lower the element access based on the {receiver_maps}.
-  return ReduceElementAccess(node, index, value, receiver_maps, access_mode,
-                             STANDARD_LOAD, store_mode);
+  return ReduceElementAccess(node, index, value, receiver_maps,
+                             AccessMode::kStoreInLiteral, STANDARD_LOAD,
+                             store_mode);
 }
 
 namespace {
@@ -2803,14 +2800,11 @@ bool JSNativeContextSpecialization::CanTreatHoleAsUndefined(
 
 bool JSNativeContextSpecialization::ExtractReceiverMaps(
     Node* receiver, Node* effect, FeedbackNexus const& nexus,
-    AccessMode access_mode, MapHandles* receiver_maps) {
+    MapHandles* receiver_maps) {
   DCHECK_EQ(0, receiver_maps->size());
   if (nexus.IsUninitialized()) return true;
-  // See if we can infer a concrete type for the {receiver}. This is only safe
-  // for loads, because for stores we need to take transition targets into
-  // account.
-  if (access_mode == AccessMode::kLoad &&
-      InferReceiverMaps(receiver, effect, receiver_maps)) {
+  // See if we can infer a concrete type for the {receiver}.
+  if (InferReceiverMaps(receiver, effect, receiver_maps)) {
     // We can assume that the {receiver} still has the inferred {receiver_maps}.
     return true;
   }

src/compiler/js-native-context-specialization.h

@@ -183,7 +183,7 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   // Extract receiver maps from {nexus} and filter based on {receiver} if
   // possible.
   bool ExtractReceiverMaps(Node* receiver, Node* effect,
-                           FeedbackNexus const& nexus, AccessMode access_mode,
+                           FeedbackNexus const& nexus,
                            MapHandles* receiver_maps);
 
   // Try to infer maps for the given {receiver} at the current {effect}.

test/mjsunit/regress/regress-7254.js

-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --opt
-
-function foo(a) {
-  a[0];
-  a[1] = "";
-}
-
-foo([0,0].map(x => x));
-foo([0,0].map(x => x));
-%OptimizeFunctionOnNextCall(foo);
-foo([0,0].map(x => x));
-assertOptimized(foo);