[turbofan] Avoid raw InferReceiverMaps in JSCallReducer

Instead provide an abstraction that makes it hard to forget
dealing with unreliable maps.

This also fixes a deopt loop in Function.prototype.bind and
one in Array.prototype.reduce.

Bug: v8:9137
Change-Id: If6a51182c8693a62e9fb6d302cec19b4d48e25cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578501
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61106}

src/compiler/js-call-reducer.h

@@ -190,11 +190,6 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
 
   Reduction ReduceNumberConstructor(Node* node);
 
-  Node* InsertMapChecksIfUnreliableReceiverMaps(
-      NodeProperties::InferReceiverMapsResult result,
-      ZoneHandleSet<Map> const& receiver_maps, VectorSlotPair const& feedback,
-      Node* receiver, Node* effect, Node* control);
-
   // Returns the updated {to} node, and updates control and effect along the
   // way.
   Node* DoFilterPostCallbackWork(ElementsKind kind, Node** control,

src/isolate.h

@@ -1168,7 +1168,13 @@ class Isolate final : private HiddenFactory {
   inline bool IsArraySpeciesLookupChainIntact();
   inline bool IsTypedArraySpeciesLookupChainIntact();
   inline bool IsRegExpSpeciesLookupChainIntact();
+
+  // Check that the @@species protector is intact, which guards the lookup of
+  // "constructor" on JSPromise instances, whose [[Prototype]] is the initial
+  // %PromisePrototype%, and the Symbol.species lookup on the
+  // %PromisePrototype%.
   inline bool IsPromiseSpeciesLookupChainIntact();
+
   bool IsIsConcatSpreadableLookupChainIntact();
   bool IsIsConcatSpreadableLookupChainIntact(JSReceiver receiver);
   inline bool IsStringLengthOverflowIntact();
@@ -1214,7 +1220,7 @@ class Isolate final : private HiddenFactory {
   inline bool IsArrayBufferDetachingIntact();
 
   // Disable promise optimizations if promise (debug) hooks have ever been
-  // active.
+  // active, because those can observe promises.
   bool IsPromiseHookProtectorIntact();
 
   // Make sure a lookup of "resolve" on the %Promise% intrinsic object

test/mjsunit/compiler/regress-9137-1.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+// Flags: --no-flush-bytecode --no-stress-flush-bytecode
+
+function changeMap(obj) {
+  obj.blub = 42;
+}
+
+function foo(obj) {
+  return obj.bind(changeMap(obj));
+}
+
+%NeverOptimizeFunction(changeMap);
+%PrepareFunctionForOptimization(foo);
+foo(function(){});
+foo(function(){});
+%OptimizeFunctionOnNextCall(foo);
+foo(function(){});
+%OptimizeFunctionOnNextCall(foo);
+foo(function(){});
+assertOptimized(foo);

test/mjsunit/compiler/regress-9137-2.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+// Flags: --no-flush-bytecode --no-stress-flush-bytecode
+
+function changeMap(obj) {
+  obj.blub = 42;
+}
+
+function reducer(acc, val, i, obj) {
+  return changeMap(obj);
+}
+
+function foo(obj) {
+  return obj.reduce(reducer);
+}
+
+%NeverOptimizeFunction(reducer);
+%PrepareFunctionForOptimization(foo);
+foo([0, 1, 2]);
+foo([0, 1, 2]);
+%OptimizeFunctionOnNextCall(foo);
+foo([0, 1, 2]);
+%OptimizeFunctionOnNextCall(foo);
+foo([0, 1, 2]);
+assertOptimized(foo);