[turbofan] Inline ReturnReceiver builtin into TurboFan.

Builtins::kReturnReceiver is used for the Symbol.iterator function on
iterators, and just returns the iterator itself. For example, for-of
or yield* with a generator will first call generator[Symbol.iterator](),
which simply returns the generator itself. Inlining this particular
builtin into TurboFan is trivial and avoids that call completely,
enabling more possibilities for LoadElimination and EscapeAnalysis
to get rid of even more checks in common generator code.

BUG=v8:6344,v8:6351,v8:6354
R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2938683002
Cr-Commit-Position: refs/heads/master@{#45927}

src/compiler/js-call-reducer.cc

@@ -779,6 +779,8 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
           return ReduceReflectGetPrototypeOf(node);
         case Builtins::kArrayForEach:
           return ReduceArrayForEach(function, node);
+        case Builtins::kReturnReceiver:
+          return ReduceReturnReceiver(node);
         default:
           break;
       }
@@ -1036,6 +1038,13 @@ Reduction JSCallReducer::ReduceJSConstructWithSpread(Node* node) {
   return ReduceSpreadCall(node, arity);
 }
 
+Reduction JSCallReducer::ReduceReturnReceiver(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  ReplaceWithValue(node, receiver);
+  return Replace(receiver);
+}
+
 Graph* JSCallReducer::graph() const { return jsgraph()->graph(); }
 
 Isolate* JSCallReducer::isolate() const { return jsgraph()->isolate(); }

src/compiler/js-call-reducer.h

@@ -57,6 +57,7 @@ class JSCallReducer final : public AdvancedReducer {
   Reduction ReduceJSConstructWithSpread(Node* node);
   Reduction ReduceJSCall(Node* node);
   Reduction ReduceJSCallWithSpread(Node* node);
+  Reduction ReduceReturnReceiver(Node* node);
 
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }