[turbofan] Less aggressively insert SOFT deopts for property access.

Sometimes TurboFan is able to extract receiver maps from the surrounding
graph and thus is able to generate reasonable code for property accesses,
even if those haven't been executed in the baseline tier yet. So, only
stick in an SOFT deoptimization exit, if ExtractReceiverMaps failed to
infer proper receiver maps.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2746013002
Cr-Commit-Position: refs/heads/master@{#43736}

src/compiler/js-native-context-specialization.cc

@@ -573,6 +573,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
       Object* maybe_constructor = receiver_map->GetConstructor();
       // Detached global proxies have |null| as their constructor.
       if (maybe_constructor->IsJSFunction() &&
+          JSFunction::cast(maybe_constructor)->has_context() &&
           JSFunction::cast(maybe_constructor)->native_context() ==
               *native_context()) {
         return ReduceGlobalAccess(node, receiver, value, name, access_mode,
@@ -799,17 +800,6 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccessFromNexus(
     }
   }
 
-  // Check if the {nexus} reports type feedback for the IC.
-  if (nexus.IsUninitialized()) {
-    if ((flags() & kDeoptimizationEnabled) &&
-        (flags() & kBailoutOnUninitialized)) {
-      return ReduceSoftDeoptimize(
-          node,
-          DeoptimizeReason::kInsufficientTypeFeedbackForGenericNamedAccess);
-    }
-    return NoChange();
-  }
-
   // Extract receiver maps from the IC using the {nexus}.
   MapHandleList receiver_maps;
   if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
@@ -1194,17 +1184,6 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
     }
   }
 
-  // Check if the {nexus} reports type feedback for the IC.
-  if (nexus.IsUninitialized()) {
-    if ((flags() & kDeoptimizationEnabled) &&
-        (flags() & kBailoutOnUninitialized)) {
-      return ReduceSoftDeoptimize(
-          node,
-          DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess);
-    }
-    return NoChange();
-  }
-
   // Extract receiver maps from the {nexus}.
   MapHandleList receiver_maps;
   if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
@@ -2250,7 +2229,10 @@ bool JSNativeContextSpecialization::ExtractReceiverMaps(
     }
     return true;
   }
-  return false;
+  // Check if the {nexus} actually reports feedback for the IC. We return
+  // true if the IC is still uninitialized, which translates to a SOFT
+  // deoptimization exit in the callers.
+  return nexus.IsUninitialized();
 }
 
 bool JSNativeContextSpecialization::InferReceiverMaps(