Revert "[turbofan] Make code and comment match in FastFunctionPrototypeBind"

This reverts commit 7ba8e662.

Reason for revert: Breaks CFI - https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20cfi/21295

Original change's description:
> [turbofan] Make code and comment match in FastFunctionPrototypeBind
> 
> Additionally, used number of own descriptors in both CSA and the
> reduction of Function.prototype.bind.
> 
> Change-Id: I7b86e059d20faa1160cdc0126932fff924226eee
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714655
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62885}

TBR=neis@chromium.org,jgruber@chromium.org,mslekova@chromium.org

Change-Id: I6a92741c214f8b86702445c60a311cc4800593e9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715449Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62886}

src/builtins/builtins-function-gen.cc

@@ -27,7 +27,7 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   Node* receiver = args.GetReceiver();
   GotoIf(TaggedIsSmi(receiver), &slow);
 
-  TNode<Map> receiver_map = LoadMap(receiver);
+  Node* receiver_map = LoadMap(receiver);
   {
     Node* instance_type = LoadMapInstanceType(receiver_map);
     GotoIfNot(
@@ -45,20 +45,20 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   // AccessorInfo objects. In that case, their value can be recomputed even if
   // the actual value on the object changes.
   Comment("Check descriptor array length");
+  TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
   // Minimum descriptor array length required for fast path.
   const int min_nof_descriptors = i::Max(JSFunction::kLengthDescriptorIndex,
-                                         JSFunction::kNameDescriptorIndex) +
-                                  1;
-  TNode<Int32T> nof_descriptors = LoadNumberOfOwnDescriptors(receiver_map);
-  GotoIf(Int32LessThan(nof_descriptors, Int32Constant(min_nof_descriptors)),
-         &slow);
+                                         JSFunction::kNameDescriptorIndex);
+  TNode<Int32T> nof_descriptors = LoadNumberOfDescriptors(descriptors);
+  GotoIf(
+      Int32LessThanOrEqual(nof_descriptors, Int32Constant(min_nof_descriptors)),
+      &slow);
 
   // Check whether the length and name properties are still present as
   // AccessorInfo objects. In that case, their value can be recomputed even if
   // the actual value on the object changes.
   Comment("Check name and length properties");
   {
-    TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
     const int length_index = JSFunction::kLengthDescriptorIndex;
     TNode<Name> maybe_length =
         LoadKeyByDescriptorEntry(descriptors, length_index);

src/codegen/code-stub-assembler.cc

@@ -1547,12 +1547,6 @@ TNode<Int32T> CodeStubAssembler::LoadNumberOfDescriptors(
                       MachineType::Int16()));
 }
 
-TNode<Int32T> CodeStubAssembler::LoadNumberOfOwnDescriptors(TNode<Map> map) {
-  Node* bit_field3 = LoadMapBitField3(map);
-  return UncheckedCast<Int32T>(
-      DecodeWord32<Map::NumberOfOwnDescriptorsBits>(bit_field3));
-}
-
 TNode<Int32T> CodeStubAssembler::LoadMapBitField(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   return UncheckedCast<Int32T>(

src/codegen/code-stub-assembler.h

@@ -940,8 +940,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       SloppyTNode<WeakFixedArray> array);
   // Load the number of descriptors in DescriptorArray.
   TNode<Int32T> LoadNumberOfDescriptors(TNode<DescriptorArray> array);
-  // Load the number of own descriptors of a map.
-  TNode<Int32T> LoadNumberOfOwnDescriptors(TNode<Map> map);
   // Load the bit field of a Map.
   TNode<Int32T> LoadMapBitField(SloppyTNode<Map> map);
   // Load bit field 2 of a map.

src/compiler/js-call-reducer.cc

@@ -550,13 +550,7 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
     // runtime otherwise.
     Handle<DescriptorArray> descriptors(
         receiver_map.object()->instance_descriptors(), isolate());
-    int minimum_nof_descriptors = std::max(JSFunction::kLengthDescriptorIndex,
-                                           JSFunction::kNameDescriptorIndex) +
-                                  1;
-    if (receiver_map.object()->NumberOfOwnDescriptors() <
-        minimum_nof_descriptors) {
-      return inference.NoChange();
-    }
+    if (descriptors->number_of_descriptors() < 2) return inference.NoChange();
     if (descriptors->GetKey(JSFunction::kLengthDescriptorIndex) !=
         ReadOnlyRoots(isolate()).length_string()) {
       return inference.NoChange();