[turbofan] Restore fast API calls with no receiver knowledge.

When TurboFan doesn't know anything about the receiver, it will
generally insert a call via CallFunctionTemplate builtin, which
does all the necessary checks. For this we don't need to be able
to deoptimize, so there's no need to have the speculation bit
available.

This restores the performance in the case of calling API methods
and accessors via `Function#call()`, i.e. like in this example:

```js
const hasAttribute = Element.prototype.hasAttribute;
// ...
hasAttribute.call(element, "bar");
```

Bug: v8:8820
Change-Id: Ic30719d7db75141023efc11d76180b001f871d28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1615248
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61604}

src/compiler/js-call-reducer.cc

@@ -2737,10 +2737,6 @@ Reduction JSCallReducer::ReduceCallApiFunction(
     Node* node, const SharedFunctionInfoRef& shared) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
-
   int const argc = static_cast<int>(p.arity()) - 2;
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* global_proxy =
@@ -2807,6 +2803,12 @@ Reduction JSCallReducer::ReduceCallApiFunction(
       if (!api_holder.is_identical_to(holderi)) return inference.NoChange();
     }
 
+    // We may need to check {receiver_maps} again below, so better
+    // make sure we are allowed to speculate in this case.
+    if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+      return inference.NoChange();
+    }
+
     // TODO(neis): The maps were used in a way that does not actually require
     // map checks or stability dependencies.
     inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,