[turbofan] Further tune MapInference in ReduceCallApiFunction

If speculation is disallowed, this change lets us still do the
optimization if (a) the maps were already reliable or
(b) we are able to take stability dependencies.

Bug: v8:8820
Change-Id: I08340fc19ac87b80aa2b7ed77753dd642e89804f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617663Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61634}

src/compiler/js-call-reducer.cc

@@ -2803,9 +2803,10 @@ Reduction JSCallReducer::ReduceCallApiFunction(
       if (!api_holder.is_identical_to(holderi)) return inference.NoChange();
     }
 
-    // We may need to check {receiver_maps} again below, so better
-    // make sure we are allowed to speculate in this case.
-    if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation &&
+        !inference.RelyOnMapsViaStability(dependencies())) {
+      // We were not able to make the receiver maps reliable without map checks
+      // but doing map checks would lead to deopt loops, so give up.
       return inference.NoChange();
     }