Reland of [turbofan] Fix and enable property stores. (patchset #1 id:1 of...

Reland of [turbofan] Fix and enable property stores. (patchset #1 id:1 of https://codereview.chromium.org/1414743005/ )

Reason for revert:
It is fixed.

Original issue's description:
> Revert of [turbofan] Fix and enable property stores. (patchset #2 id:20001 of https://codereview.chromium.org/1424523002/ )
>
> Reason for revert:
> [Sheriff] Breaks benchmarks:
> http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%20avx2/builds/3164
>
> Original issue's description:
> > [turbofan] Fix and enable property stores.
> >
> > Fix lookup for storing to properties, and also make sure we don't embed
> > deprecated map (using Map::TryUpdate).
> >
> > R=jarin@chromium.org
> > BUG=v8:4470
> > LOG=n
> >
> > Committed: https://crrev.com/70158828b3db8e582344272c6c11a957f4d8b2c8
> > Cr-Commit-Position: refs/heads/master@{#31509}
>
> TBR=jarin@chromium.org,bmeurer@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4470
>
> Committed: https://crrev.com/50e5a7275f2bc93a8ae731acda0f7ac6e5e97c3c
> Cr-Commit-Position: refs/heads/master@{#31513}

TBR=jarin@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1421573003

Cr-Commit-Position: refs/heads/master@{#31514}

src/compiler/js-native-context-specialization.cc

@@ -312,7 +312,8 @@ bool JSNativeContextSpecialization::ComputePropertyAccessInfo(
     Handle<Map> map, Handle<Name> name, PropertyAccessMode access_mode,
     PropertyAccessInfo* access_info) {
   MaybeHandle<JSObject> holder;
-  Type* receiver_type = Type::Class(map, graph()->zone());
+  Handle<Map> receiver_map = map;
+  Type* receiver_type = Type::Class(receiver_map, graph()->zone());
   while (CanInlinePropertyAccess(map)) {
     // Check for special JSObject field accessors.
     int offset;
@@ -356,6 +357,9 @@ bool JSNativeContextSpecialization::ComputePropertyAccessInfo(
     Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
     int const number = descriptors->SearchWithCache(*name, *map);
     if (number != DescriptorArray::kNotFound) {
+      if (access_mode == kStore && !map.is_identical_to(receiver_map)) {
+        return false;
+      }
       PropertyDetails const details = descriptors->GetDetails(number);
       if (details.type() == DATA_CONSTANT) {
         *access_info = PropertyAccessInfo::DataConstant(
@@ -364,14 +368,14 @@ bool JSNativeContextSpecialization::ComputePropertyAccessInfo(
         return true;
       } else if (details.type() == DATA) {
         // Don't bother optimizing stores to read-only properties.
-        if (access_mode == kStore) {
+        if (access_mode == kStore && details.IsReadOnly()) {
           break;
         }
         int index = descriptors->GetFieldIndex(number);
         Representation field_representation = details.representation();
         FieldIndex field_index = FieldIndex::ForPropertyIndex(
             *map, index, field_representation.IsDouble());
-        Type* field_type = Type::Any();
+        Type* field_type = Type::Tagged();
         if (field_representation.IsSmi()) {
           field_type = Type::Intersect(Type::SignedSmall(),
                                        Type::TaggedSigned(), graph()->zone());
@@ -454,11 +458,13 @@ bool JSNativeContextSpecialization::ComputePropertyAccessInfos(
     PropertyAccessMode access_mode,
     ZoneVector<PropertyAccessInfo>* access_infos) {
   for (Handle<Map> map : maps) {
-    PropertyAccessInfo access_info;
-    if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
-      return false;
+    if (Map::TryUpdate(map).ToHandle(&map)) {
+      PropertyAccessInfo access_info;
+      if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
+        return false;
+      }
+      access_infos->push_back(access_info);
     }
-    access_infos->push_back(access_info);
   }
   return true;
 }
@@ -488,7 +494,9 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
   if (!ComputePropertyAccessInfos(receiver_maps, name, kLoad, &access_infos)) {
     return NoChange();
   }
-  DCHECK(!access_infos.empty());
+
+  // Nothing to do if we have no non-deprecated maps.
+  if (access_infos.empty()) return NoChange();
 
   // The final states for every polymorphic branch. We join them with
   // Merge+Phi+EffectPhi at the bottom.
@@ -774,7 +782,6 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreNamed(Node* node) {
     // Determine actual holder and perform prototype chain checks.
     Handle<JSObject> holder;
     if (access_info.holder().ToHandle(&holder)) {
-      this_receiver = jsgraph()->Constant(holder);
       for (auto i = access_info.receiver_type()->Classes(); !i.Done();
            i.Advance()) {
         Handle<Map> map = i.Current();