Revert "[turbofan] Brokerize Function.prototype.bind"

This reverts commit 49f8323f.

Reason for revert: breaks https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20cfi/21302

Original change's description:
> [turbofan] Brokerize Function.prototype.bind
> 
> Bug: v8:7790
> Change-Id: I2985f5740b947445723ce0f5072a32be48d22be1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709410
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62895}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: I7cf4ca1ef50d5d467484b94e067f7fc1b54d7a94
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715454Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62896}

src/compiler/heap-refs.h

@@ -71,7 +71,6 @@ enum class OddballType : uint8_t {
   V(String)                        \
   V(Symbol)                        \
   /* Subtypes of HeapObject */     \
-  V(AccessorInfo)                  \
   V(AllocationSite)                \
   V(BigInt)                        \
   V(CallHandlerInfo)               \
@@ -234,9 +233,10 @@ class JSObjectRef : public HeapObjectRef {
 
   // Return the value of the property identified by the field {index}
   // if {index} is known to be an own data property of the object.
-  base::Optional<ObjectRef> GetOwnDataProperty(
-      Representation field_representation, FieldIndex index,
+  base::Optional<ObjectRef> GetOwnProperty(Representation field_representation,
+                                           FieldIndex index,
                                            bool serialize = false) const;
+
   FixedArrayBaseRef elements() const;
   void SerializeElements();
   void EnsureElementsTenured();
@@ -463,12 +463,6 @@ class CallHandlerInfoRef : public HeapObjectRef {
   ObjectRef data() const;
 };
 
-class AccessorInfoRef : public HeapObjectRef {
- public:
-  using HeapObjectRef::HeapObjectRef;
-  Handle<AccessorInfo> object() const;
-};
-
 class AllocationSiteRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
@@ -556,14 +550,12 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
   // Concerning the underlying instance_descriptors:
   void SerializeOwnDescriptors();
   void SerializeOwnDescriptor(int descriptor_index);
-  bool serialized_own_descriptor(int descriptor_index) const;
   MapRef FindFieldOwner(int descriptor_index) const;
   PropertyDetails GetPropertyDetails(int descriptor_index) const;
   NameRef GetPropertyKey(int descriptor_index) const;
   FieldIndex GetFieldIndexFor(int descriptor_index) const;
   ObjectRef GetFieldType(int descriptor_index) const;
   bool IsUnboxedDoubleField(int descriptor_index) const;
-  ObjectRef GetStrongValue(int descriptor_number) const;
 
   // Available after calling JSFunctionRef::Serialize on a function that has
   // this map as initial map.

src/compiler/js-call-reducer.cc

@@ -487,6 +487,9 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
   NodeProperties::ChangeOp(
       node,
       javascript()->Call(arity, p.frequency(), VectorSlotPair(), convert_mode));
+  // TODO(mslekova): Remove once ReduceJSCall is brokerized.
+  AllowHandleDereference allow_handle_dereference;
+  AllowHandleAllocation allow_handle_allocation;
   // Try to further reduce the JSCall {node}.
   Reduction const reduction = ReduceJSCall(node);
   return reduction.Changed() ? reduction : Changed(node);
@@ -494,8 +497,6 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
 
 // ES section #sec-function.prototype.bind
 Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
-  DisallowHeapAccessIf no_heap_acess(FLAG_concurrent_inlining);
-
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
@@ -526,32 +527,14 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
 
   MapRef first_receiver_map(broker(), receiver_maps[0]);
   bool const is_constructor = first_receiver_map.is_constructor();
-
-  if (FLAG_concurrent_inlining) {
-    if (!first_receiver_map.serialized_prototype()) {
-      TRACE_BROKER_MISSING(
-          broker(), "serialized prototype on map " << first_receiver_map);
-      return inference.NoChange();
-    }
-  } else {
   first_receiver_map.SerializePrototype();
-  }
   ObjectRef const prototype = first_receiver_map.prototype();
   for (Handle<Map> const map : receiver_maps) {
     MapRef receiver_map(broker(), map);
 
-    if (FLAG_concurrent_inlining) {
-      if (!receiver_map.serialized_prototype()) {
-        TRACE_BROKER_MISSING(broker(),
-                             "serialized prototype on map " << receiver_map);
-        return inference.NoChange();
-      }
-    } else {
-      receiver_map.SerializePrototype();
-    }
-
     // Check for consistency among the {receiver_maps}.
     STATIC_ASSERT(LAST_TYPE == LAST_FUNCTION_TYPE);
+    receiver_map.SerializePrototype();
     if (!receiver_map.prototype().equals(prototype) ||
         receiver_map.is_constructor() != is_constructor ||
         receiver_map.instance_type() < FIRST_FUNCTION_TYPE) {
@@ -567,31 +550,28 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
     // recomputed even if the actual value of the object changes.
     // This mirrors the checks done in builtins-function-gen.cc at
     // runtime otherwise.
-    int minimum_nof_descriptors = std::max(JSFunction::kLengthDescriptorIndex,
+    Handle<DescriptorArray> descriptors(
+        receiver_map.object()->instance_descriptors(), isolate());
+    int minimum_nof_descriptors = i::Max(JSFunction::kLengthDescriptorIndex,
                                          JSFunction::kNameDescriptorIndex) +
                                   1;
-    if (receiver_map.NumberOfOwnDescriptors() < minimum_nof_descriptors) {
+    if (receiver_map.object()->NumberOfOwnDescriptors() <
+        minimum_nof_descriptors) {
+      return inference.NoChange();
+    }
+    if (descriptors->GetKey(JSFunction::kLengthDescriptorIndex) !=
+        ReadOnlyRoots(isolate()).length_string()) {
+      return inference.NoChange();
+    }
+    if (!descriptors->GetStrongValue(JSFunction::kLengthDescriptorIndex)
+             .IsAccessorInfo()) {
       return inference.NoChange();
     }
-    if (!receiver_map.serialized_own_descriptor(
-            JSFunction::kLengthDescriptorIndex) ||
-        !receiver_map.serialized_own_descriptor(
-            JSFunction::kNameDescriptorIndex)) {
-      TRACE_BROKER_MISSING(broker(),
-                           "serialized descriptors on map " << receiver_map);
+    if (descriptors->GetKey(JSFunction::kNameDescriptorIndex) !=
+        ReadOnlyRoots(isolate()).name_string()) {
       return inference.NoChange();
     }
-    ReadOnlyRoots roots(isolate());
-    StringRef length_string(broker(), roots.length_string_handle());
-    StringRef name_string(broker(), roots.name_string_handle());
-
-    if (!receiver_map.GetPropertyKey(JSFunction::kLengthDescriptorIndex)
-             .equals(length_string) ||
-        !receiver_map.GetStrongValue(JSFunction::kLengthDescriptorIndex)
-             .IsAccessorInfo() ||
-        !receiver_map.GetPropertyKey(JSFunction::kNameDescriptorIndex)
-             .equals(name_string) ||
-        !receiver_map.GetStrongValue(JSFunction::kNameDescriptorIndex)
+    if (!descriptors->GetStrongValue(JSFunction::kNameDescriptorIndex)
              .IsAccessorInfo()) {
       return inference.NoChange();
     }
@@ -675,6 +655,9 @@ Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
   NodeProperties::ChangeOp(
       node,
       javascript()->Call(arity, p.frequency(), VectorSlotPair(), convert_mode));
+  // TODO(mslekova): Remove once ReduceJSCall is brokerized.
+  AllowHandleDereference allow_handle_dereference;
+  AllowHandleAllocation allow_handle_allocation;
   // Try to further reduce the JSCall {node}.
   Reduction const reduction = ReduceJSCall(node);
   return reduction.Changed() ? reduction : Changed(node);
@@ -3336,10 +3319,6 @@ base::Optional<HeapObjectRef> GetHeapObjectFeedback(
 }  // namespace
 
 Reduction JSCallReducer::ReduceJSCall(Node* node) {
-  // TODO(mslekova): Remove once ReduceJSCall is brokerized.
-  AllowHandleDereference allow_handle_dereference;
-  AllowHandleAllocation allow_handle_allocation;
-
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
   Node* target = NodeProperties::GetValueInput(node, 0);
@@ -7234,7 +7213,7 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
     JSObjectRef holder_ref(broker(), holder);
 
     // Bail out if the exec method is not the original one.
-    base::Optional<ObjectRef> constant = holder_ref.GetOwnDataProperty(
+    base::Optional<ObjectRef> constant = holder_ref.GetOwnProperty(
         ai_exec.field_representation(), ai_exec.field_index());
     if (!constant.has_value() ||
         !constant->equals(native_context().regexp_exec_function())) {

src/compiler/js-heap-broker.cc

@@ -256,6 +256,12 @@ class JSObjectField {
   uint64_t number_bits_ = 0;
 };
 
+struct FieldIndexHasher {
+  size_t operator()(FieldIndex field_index) const {
+    return field_index.index();
+  }
+};
+
 class JSObjectData : public HeapObjectData {
  public:
   JSObjectData(JSHeapBroker* broker, ObjectData** storage,
@@ -278,7 +284,7 @@ class JSObjectData : public HeapObjectData {
 
   ObjectData* GetOwnConstantElement(JSHeapBroker* broker, uint32_t index,
                                     bool serialize);
-  ObjectData* GetOwnDataProperty(JSHeapBroker* broker,
+  ObjectData* GetOwnProperty(JSHeapBroker* broker,
                              Representation representation,
                              FieldIndex field_index, bool serialize);
 
@@ -310,9 +316,7 @@ class JSObjectData : public HeapObjectData {
   // (2) are known not to (possibly they don't exist at all).
   // In case (2), the second pair component is nullptr.
   // For simplicity, this may in theory overlap with inobject_fields_.
-  // The keys of the map are the property_index() values of the
-  // respective property FieldIndex'es.
-  ZoneUnorderedMap<int, ObjectData*> own_properties_;
+  ZoneUnorderedMap<FieldIndex, ObjectData*, FieldIndexHasher> own_properties_;
 };
 
 void JSObjectData::SerializeObjectCreateMap(JSHeapBroker* broker) {
@@ -349,7 +353,7 @@ base::Optional<ObjectRef> GetOwnElementFromHeap(JSHeapBroker* broker,
   return base::nullopt;
 }
 
-ObjectRef GetOwnDataPropertyFromHeap(JSHeapBroker* broker,
+ObjectRef GetOwnPropertyFromHeap(JSHeapBroker* broker,
                                  Handle<JSObject> receiver,
                                  Representation representation,
                                  FieldIndex field_index) {
@@ -357,7 +361,6 @@ ObjectRef GetOwnDataPropertyFromHeap(JSHeapBroker* broker,
       JSObject::FastPropertyAt(receiver, representation, field_index);
   return ObjectRef(broker, constant);
 }
-
 }  // namespace
 
 ObjectData* JSObjectData::GetOwnConstantElement(JSHeapBroker* broker,
@@ -379,11 +382,11 @@ ObjectData* JSObjectData::GetOwnConstantElement(JSHeapBroker* broker,
   return result;
 }
 
-ObjectData* JSObjectData::GetOwnDataProperty(JSHeapBroker* broker,
+ObjectData* JSObjectData::GetOwnProperty(JSHeapBroker* broker,
                                          Representation representation,
                                          FieldIndex field_index,
                                          bool serialize) {
-  auto p = own_properties_.find(field_index.property_index());
+  auto p = own_properties_.find(field_index);
   if (p != own_properties_.end()) return p->second;
 
   if (!serialize) {
@@ -393,10 +396,10 @@ ObjectData* JSObjectData::GetOwnDataProperty(JSHeapBroker* broker,
     return nullptr;
   }
 
-  ObjectRef property = GetOwnDataPropertyFromHeap(
+  ObjectRef property = GetOwnPropertyFromHeap(
       broker, Handle<JSObject>::cast(object()), representation, field_index);
   ObjectData* result(property.data());
-  own_properties_.insert(std::make_pair(field_index.property_index(), result));
+  own_properties_.insert(std::make_pair(field_index, result));
   return result;
 }
 
@@ -839,12 +842,6 @@ bool IsInlinableFastLiteral(Handle<JSObject> boilerplate) {
 
 }  // namespace
 
-class AccessorInfoData : public HeapObjectData {
- public:
-  AccessorInfoData(JSHeapBroker* broker, ObjectData** storage,
-                   Handle<AccessorInfo> object);
-};
-
 class AllocationSiteData : public HeapObjectData {
  public:
   AllocationSiteData(JSHeapBroker* broker, ObjectData** storage,
@@ -894,7 +891,6 @@ class ScriptContextTableData : public HeapObjectData {
 
 struct PropertyDescriptor {
   NameData* key = nullptr;
-  ObjectData* value = nullptr;
   PropertyDetails details = PropertyDetails::Empty();
   FieldIndex field_index;
   MapData* field_owner = nullptr;
@@ -946,7 +942,6 @@ class MapData : public HeapObjectData {
   // on field owner(s).
   void SerializeOwnDescriptor(JSHeapBroker* broker, int descriptor_index);
   void SerializeOwnDescriptors(JSHeapBroker* broker);
-  ObjectData* GetStrongValue(int descriptor_index) const;
   DescriptorArrayData* instance_descriptors() const {
     return instance_descriptors_;
   }
@@ -1011,10 +1006,6 @@ class MapData : public HeapObjectData {
   bool serialized_for_element_store_ = false;
 };
 
-AccessorInfoData::AccessorInfoData(JSHeapBroker* broker, ObjectData** storage,
-                                   Handle<AccessorInfo> object)
-    : HeapObjectData(broker, storage, object) {}
-
 AllocationSiteData::AllocationSiteData(JSHeapBroker* broker,
                                        ObjectData** storage,
                                        Handle<AllocationSite> object)
@@ -1905,13 +1896,6 @@ void MapData::SerializeOwnDescriptors(JSHeapBroker* broker) {
   }
 }
 
-ObjectData* MapData::GetStrongValue(int descriptor_index) const {
-  auto data = instance_descriptors_->contents().find(descriptor_index);
-  if (data == instance_descriptors_->contents().end()) return nullptr;
-
-  return data->second.value;
-}
-
 void MapData::SerializeOwnDescriptor(JSHeapBroker* broker,
                                      int descriptor_index) {
   TraceScope tracer(broker, this, "MapData::SerializeOwnDescriptor");
@@ -1923,7 +1907,7 @@ void MapData::SerializeOwnDescriptor(JSHeapBroker* broker,
   }
 
   ZoneMap<int, PropertyDescriptor>& contents =
-      instance_descriptors()->contents();
+      instance_descriptors_->contents();
   CHECK_LT(descriptor_index, map->NumberOfOwnDescriptors());
   if (contents.find(descriptor_index) != contents.end()) return;
 
@@ -1935,11 +1919,6 @@ void MapData::SerializeOwnDescriptor(JSHeapBroker* broker,
   PropertyDescriptor d;
   d.key =
       broker->GetOrCreateData(descriptors->GetKey(descriptor_index))->AsName();
-  MaybeObject value = descriptors->GetValue(descriptor_index);
-  HeapObject obj;
-  if (value.GetHeapObjectIfStrong(&obj)) {
-    d.value = broker->GetOrCreateData(handle(obj, broker->isolate()));
-  }
   d.details = descriptors->GetDetails(descriptor_index);
   if (d.details.location() == kField) {
     d.field_index = FieldIndex::ForDescriptor(*map, descriptor_index);
@@ -3150,17 +3129,6 @@ BIMODAL_ACCESSOR_C(String, int, length)
 
 BIMODAL_ACCESSOR(FeedbackCell, HeapObject, value)
 
-ObjectRef MapRef::GetStrongValue(int descriptor_index) const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    return ObjectRef(broker(),
-                     handle(object()->instance_descriptors().GetStrongValue(
-                                descriptor_index),
-                            broker()->isolate()));
-  }
-  return ObjectRef(broker(), data()->AsMap()->GetStrongValue(descriptor_index));
-}
-
 void* JSTypedArrayRef::external_pointer() const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleDereference allow_handle_dereference;
@@ -3346,15 +3314,14 @@ base::Optional<ObjectRef> ObjectRef::GetOwnConstantElement(
   return ObjectRef(broker(), element);
 }
 
-base::Optional<ObjectRef> JSObjectRef::GetOwnDataProperty(
+base::Optional<ObjectRef> JSObjectRef::GetOwnProperty(
     Representation field_representation, FieldIndex index,
     bool serialize) const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
-    return GetOwnDataPropertyFromHeap(broker(),
-                                      Handle<JSObject>::cast(object()),
+    return GetOwnPropertyFromHeap(broker(), Handle<JSObject>::cast(object()),
                                   field_representation, index);
   }
-  ObjectData* property = data()->AsJSObject()->GetOwnDataProperty(
+  ObjectData* property = data()->AsJSObject()->GetOwnProperty(
       broker(), field_representation, index, serialize);
   if (property == nullptr) return base::nullopt;
   return ObjectRef(broker(), property);
@@ -3736,16 +3703,6 @@ void MapRef::SerializeOwnDescriptor(int descriptor_index) {
   data()->AsMap()->SerializeOwnDescriptor(broker(), descriptor_index);
 }
 
-bool MapRef::serialized_own_descriptor(int descriptor_index) const {
-  CHECK_LT(descriptor_index, NumberOfOwnDescriptors());
-  if (broker()->mode() == JSHeapBroker::kDisabled) return true;
-  DescriptorArrayData* desc_array_data =
-      data()->AsMap()->instance_descriptors();
-  if (!desc_array_data) return false;
-  return desc_array_data->contents().find(descriptor_index) !=
-         desc_array_data->contents().end();
-}
-
 void MapRef::SerializeBackPointer() {
   if (broker()->mode() == JSHeapBroker::kDisabled) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);

src/compiler/serializer-for-background-compilation.cc

@@ -361,8 +361,7 @@ class SerializerForBackgroundCompilation {
       FunctionTemplateInfoRef& target,  // NOLINT(runtime/references)
       Handle<Map> receiver);
   void ProcessBuiltinCall(Handle<SharedFunctionInfo> target,
-                          const HintsVector& arguments,
-                          SpeculationMode speculation_mode);
+                          const HintsVector& arguments);
 
   void ProcessJump(interpreter::BytecodeArrayIterator* iterator);
 
@@ -377,7 +376,6 @@ class SerializerForBackgroundCompilation {
   void ProcessHintsForRegExpTest(Hints const& regexp_hints);
   PropertyAccessInfo ProcessMapForRegExpTest(MapRef map);
   void ProcessHintsForFunctionCall(Hints const& target_hints);
-  void ProcessHintsForFunctionBind(Hints const& receiver_hints);
 
   GlobalAccessFeedback const* ProcessFeedbackForGlobalAccess(FeedbackSlot slot);
   NamedAccessFeedback const* ProcessFeedbackMapsForNamedAccess(
@@ -1494,8 +1492,6 @@ void SerializerForBackgroundCompilation::ProcessCallOrConstruct(
   }
 
   environment()->accumulator_hints().Clear();
-  FeedbackNexus nexus(environment()->function().feedback_vector(), slot);
-  SpeculationMode speculation_mode = nexus.GetSpeculationMode();
 
   for (auto hint : callee.constants()) {
     if (!hint->IsJSFunction()) continue;
@@ -1509,7 +1505,7 @@ void SerializerForBackgroundCompilation::ProcessCallOrConstruct(
       ProcessApiCall(shared, arguments);
       DCHECK(!shared->IsInlineable());
     } else if (shared->HasBuiltinId()) {
-      ProcessBuiltinCall(shared, arguments, speculation_mode);
+      ProcessBuiltinCall(shared, arguments);
       DCHECK(!shared->IsInlineable());
     }
 
@@ -1527,7 +1523,7 @@ void SerializerForBackgroundCompilation::ProcessCallOrConstruct(
       ProcessApiCall(shared, arguments);
       DCHECK(!shared->IsInlineable());
     } else if (shared->HasBuiltinId()) {
-      ProcessBuiltinCall(shared, arguments, speculation_mode);
+      ProcessBuiltinCall(shared, arguments);
       DCHECK(!shared->IsInlineable());
     }
 
@@ -1612,8 +1608,7 @@ void SerializerForBackgroundCompilation::ProcessReceiverMapForApiCall(
 }
 
 void SerializerForBackgroundCompilation::ProcessBuiltinCall(
-    Handle<SharedFunctionInfo> target, const HintsVector& arguments,
-    SpeculationMode speculation_mode) {
+    Handle<SharedFunctionInfo> target, const HintsVector& arguments) {
   DCHECK(target->HasBuiltinId());
   const int builtin_id = target->builtin_id();
   const char* name = Builtins::name(builtin_id);
@@ -1621,26 +1616,20 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
   switch (builtin_id) {
     case Builtins::kPromisePrototypeCatch: {
       // For JSCallReducer::ReducePromisePrototypeCatch.
-      if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
       CHECK_GE(arguments.size(), 1);
       ProcessMapHintsForPromises(arguments[0]);
-      }
       break;
     }
     case Builtins::kPromisePrototypeFinally: {
       // For JSCallReducer::ReducePromisePrototypeFinally.
-      if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
       CHECK_GE(arguments.size(), 1);
       ProcessMapHintsForPromises(arguments[0]);
-      }
       break;
     }
     case Builtins::kPromisePrototypeThen: {
       // For JSCallReducer::ReducePromisePrototypeThen.
-      if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
       CHECK_GE(arguments.size(), 1);
       ProcessMapHintsForPromises(arguments[0]);
-      }
       break;
     }
     case Builtins::kPromiseResolveTrampoline:
@@ -1661,27 +1650,18 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
       break;
     case Builtins::kRegExpPrototypeTest: {
       // For JSCallReducer::ReduceRegExpPrototypeTest.
-      if (arguments.size() >= 1 &&
-          speculation_mode != SpeculationMode::kDisallowSpeculation) {
+      if (arguments.size() >= 1) {
         Hints const& regexp_hints = arguments[0];
         ProcessHintsForRegExpTest(regexp_hints);
       }
       break;
     }
     case Builtins::kFunctionPrototypeCall:
-      if (arguments.size() >= 1 &&
-          speculation_mode != SpeculationMode::kDisallowSpeculation) {
+      if (arguments.size() >= 1) {
         Hints const& target_hints = arguments[0];
         ProcessHintsForFunctionCall(target_hints);
       }
       break;
-    case Builtins::kFastFunctionPrototypeBind:
-      if (arguments.size() >= 2 &&
-          speculation_mode != SpeculationMode::kDisallowSpeculation) {
-        Hints const& receiver_hints = arguments[1];
-        ProcessHintsForFunctionBind(receiver_hints);
-      }
-      break;
     default:
       break;
   }
@@ -1728,7 +1708,7 @@ PropertyAccessInfo SerializerForBackgroundCompilation::ProcessMapForRegExpTest(
   if (ai_exec.IsDataConstant() && ai_exec.holder().ToHandle(&holder)) {
     // The property is on the prototype chain.
     JSObjectRef holder_ref(broker(), holder);
-    holder_ref.GetOwnDataProperty(ai_exec.field_representation(),
+    holder_ref.GetOwnProperty(ai_exec.field_representation(),
                               ai_exec.field_index(), true);
   }
   return ai_exec;
@@ -1746,7 +1726,7 @@ void SerializerForBackgroundCompilation::ProcessHintsForRegExpTest(
     if (ai_exec.IsDataConstant() && !ai_exec.holder().ToHandle(&holder)) {
       // The property is on the object itself.
       JSObjectRef holder_ref(broker(), regexp);
-      holder_ref.GetOwnDataProperty(ai_exec.field_representation(),
+      holder_ref.GetOwnProperty(ai_exec.field_representation(),
                                 ai_exec.field_index(), true);
     }
   }
@@ -1766,35 +1746,6 @@ void SerializerForBackgroundCompilation::ProcessHintsForFunctionCall(
   }
 }
 
-namespace {
-void ProcessMapForFunctionBind(MapRef map) {
-  map.SerializePrototype();
-  int min_nof_descriptors = i::Max(JSFunction::kLengthDescriptorIndex,
-                                   JSFunction::kNameDescriptorIndex) +
-                            1;
-  if (map.NumberOfOwnDescriptors() >= min_nof_descriptors) {
-    map.SerializeOwnDescriptor(JSFunction::kLengthDescriptorIndex);
-    map.SerializeOwnDescriptor(JSFunction::kNameDescriptorIndex);
-  }
-}
-}  // namespace
-
-void SerializerForBackgroundCompilation::ProcessHintsForFunctionBind(
-    Hints const& receiver_hints) {
-  for (auto constant : receiver_hints.constants()) {
-    if (!constant->IsJSFunction()) continue;
-    JSFunctionRef function(broker(), constant);
-    function.Serialize();
-    ProcessMapForFunctionBind(function.map());
-  }
-
-  for (auto map : receiver_hints.maps()) {
-    if (!map->IsJSFunctionMap()) continue;
-    MapRef map_ref(broker(), map);
-    ProcessMapForFunctionBind(map_ref);
-  }
-}
-
 void SerializerForBackgroundCompilation::ContributeToJumpTargetEnvironment(
     int target_offset) {
   auto it = jump_target_environments_.find(target_offset);