Revert "[turbofan] Reland^2 "Polymorphic inlining - try merge map check...

Revert "[turbofan] Reland^2 "Polymorphic inlining - try merge map check dispatch with function call dispatch.""

This reverts commit 8cf4aafc.

Reason for revert: Likely crashes Canary.

https://crash.corp.google.com/browse?q=product.name%3D%27Chrome_Mac%27%20AND%20product.version%3D%2763.0.3207.0%27%20AND%20custom_data.ChromeCrashProto.channel%3D%27canary%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27renderer%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27v8%3A%3Ainternal%3A%3Acompiler%3A%3AGraphTrimmer%3A%3ATrimGraph%27&sql_dialect=dremelsql&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D&unnest=

Original change's description:
> [turbofan] Reland^2 "Polymorphic inlining - try merge map check dispatch with function call dispatch."
> 
> This reverts commit e26e6d88.
> 
> Bug: chromium:758096
> Change-Id: I1d8ecda995c93c84a9a3c24da041fdb730dbd3b2
> Reviewed-on: https://chromium-review.googlesource.com/628169
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47812}

TBR=jarin@chromium.org,tebbi@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:758096
Change-Id: I96b62d08efa25ac1ead30e08401919d42a20ca1b
Reviewed-on: https://chromium-review.googlesource.com/652370Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47845}

src/compiler/js-inlining-heuristic.h

@@ -64,17 +64,6 @@ class JSInliningHeuristic final : public AdvancedReducer {
   // Dumps candidates to console.
   void PrintCandidates();
   Reduction InlineCandidate(Candidate const& candidate, bool force_inline);
-  void CreateOrReuseDispatch(Node* node, Node* callee,
-                             Candidate const& candidate, Node** if_successes,
-                             Node** calls, Node** inputs, int input_count);
-  bool TryReuseDispatch(Node* node, Node* callee, Candidate const& candidate,
-                        Node** if_successes, Node** calls, Node** inputs,
-                        int input_count);
-  enum StateCloneMode { kCloneState, kChangeInPlace };
-  Node* DuplicateFrameStateAndRename(Node* frame_state, Node* from, Node* to,
-                                     StateCloneMode mode);
-  Node* DuplicateStateValuesAndRename(Node* state_values, Node* from, Node* to,
-                                      StateCloneMode mode);
 
   CommonOperatorBuilder* common() const;
   Graph* graph() const;

test/mjsunit/compiler/regress-758096.js

-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-var x = 1;
-x.__proto__.f = function() { return 1; }
-
-function g() {}
-g.prototype.f =  function() { return 3; };
-var y = new g();
-
-function f(obj) {
-  return obj.f();
-}
-
-f(x);
-f(y);
-f(x);
-f(y);
-%OptimizeFunctionOnNextCall(f);
-assertEquals(1, f(x));
-assertEquals(3, f(y));