Revert of [turbofan] Fix and enable property stores. (patchset #2 id:20001 of...

Revert of [turbofan] Fix and enable property stores. (patchset #2 id:20001 of https://codereview.chromium.org/1424523002/ )

Reason for revert:
[Sheriff] Breaks benchmarks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%20avx2/builds/3164

Original issue's description:
> [turbofan] Fix and enable property stores.
>
> Fix lookup for storing to properties, and also make sure we don't embed
> deprecated map (using Map::TryUpdate).
>
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/70158828b3db8e582344272c6c11a957f4d8b2c8
> Cr-Commit-Position: refs/heads/master@{#31509}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1414743005

Cr-Commit-Position: refs/heads/master@{#31513}

src/compiler/js-native-context-specialization.cc

@@ -312,8 +312,7 @@ bool JSNativeContextSpecialization::ComputePropertyAccessInfo(
     Handle<Map> map, Handle<Name> name, PropertyAccessMode access_mode,
     PropertyAccessInfo* access_info) {
   MaybeHandle<JSObject> holder;
-  Handle<Map> receiver_map = map;
-  Type* receiver_type = Type::Class(receiver_map, graph()->zone());
+  Type* receiver_type = Type::Class(map, graph()->zone());
   while (CanInlinePropertyAccess(map)) {
     // Check for special JSObject field accessors.
     int offset;
@@ -357,9 +356,6 @@ bool JSNativeContextSpecialization::ComputePropertyAccessInfo(
     Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
     int const number = descriptors->SearchWithCache(*name, *map);
     if (number != DescriptorArray::kNotFound) {
-      if (access_mode == kStore && !map.is_identical_to(receiver_map)) {
-        return false;
-      }
       PropertyDetails const details = descriptors->GetDetails(number);
       if (details.type() == DATA_CONSTANT) {
         *access_info = PropertyAccessInfo::DataConstant(
@@ -368,14 +364,14 @@ bool JSNativeContextSpecialization::ComputePropertyAccessInfo(
         return true;
       } else if (details.type() == DATA) {
         // Don't bother optimizing stores to read-only properties.
-        if (access_mode == kStore && details.IsReadOnly()) {
+        if (access_mode == kStore) {
           break;
         }
         int index = descriptors->GetFieldIndex(number);
         Representation field_representation = details.representation();
         FieldIndex field_index = FieldIndex::ForPropertyIndex(
             *map, index, field_representation.IsDouble());
-        Type* field_type = Type::Tagged();
+        Type* field_type = Type::Any();
         if (field_representation.IsSmi()) {
           field_type = Type::Intersect(Type::SignedSmall(),
                                        Type::TaggedSigned(), graph()->zone());
@@ -458,13 +454,11 @@ bool JSNativeContextSpecialization::ComputePropertyAccessInfos(
     PropertyAccessMode access_mode,
     ZoneVector<PropertyAccessInfo>* access_infos) {
   for (Handle<Map> map : maps) {
-    if (Map::TryUpdate(map).ToHandle(&map)) {
-      PropertyAccessInfo access_info;
-      if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
-        return false;
-      }
-      access_infos->push_back(access_info);
+    PropertyAccessInfo access_info;
+    if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
+      return false;
     }
+    access_infos->push_back(access_info);
   }
   return true;
 }
@@ -494,9 +488,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
   if (!ComputePropertyAccessInfos(receiver_maps, name, kLoad, &access_infos)) {
     return NoChange();
   }
-
-  // Nothing to do if we have no non-deprecated maps.
-  if (access_infos.empty()) return NoChange();
+  DCHECK(!access_infos.empty());
 
   // The final states for every polymorphic branch. We join them with
   // Merge+Phi+EffectPhi at the bottom.
@@ -782,6 +774,7 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreNamed(Node* node) {
     // Determine actual holder and perform prototype chain checks.
     Handle<JSObject> holder;
     if (access_info.holder().ToHandle(&holder)) {
+      this_receiver = jsgraph()->Constant(holder);
       for (auto i = access_info.receiver_type()->Classes(); !i.Done();
            i.Advance()) {
         Handle<Map> map = i.Current();