[turbofan] Infer maps of JSPerformPromiseThen and JSCreatePromise.

Teach TurboFan about the maps produced by JSPerformPromiseThen and
JSCreatePromise, which yields a ~1-2% improvement on the doxbee
promises benchmark by removing the redundant checks from the optimized
code with promise chaining.

Bug: v8:7253
Change-Id: If0edce8ba15917c1b7e76b9d06490cfffe911650
Reviewed-on: https://chromium-review.googlesource.com/c/1288639Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56778}

src/compiler/js-call-reducer.cc

@@ -6064,6 +6064,19 @@ Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
   result = effect = graph()->NewNode(
       javascript()->PerformPromiseThen(), receiver, on_fulfilled, on_rejected,
       result, context, frame_state, effect, control);
+
+  // At this point we know that {result} is going to have the
+  // initial Promise map, since even if {PerformPromiseThen}
+  // above called into the host rejection tracker, the {result}
+  // doesn't escape to user JavaScript. So bake this information
+  // into the graph such that subsequent passes can use the
+  // information for further optimizations.
+  Handle<Map> result_map(native_context()->promise_function()->initial_map(),
+                         isolate());
+  effect =
+      graph()->NewNode(simplified()->MapGuard(ZoneHandleSet<Map>(result_map)),
+                       result, effect, control);
+
   ReplaceWithValue(node, result, effect, control);
   return Replace(result);
 }

src/compiler/node-properties.cc

@@ -428,6 +428,16 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
         }
         break;
       }
+      case IrOpcode::kJSCreatePromise: {
+        if (IsSame(receiver, effect)) {
+          *maps_return = ZoneHandleSet<Map>(broker->native_context()
+                                                .promise_function()
+                                                .initial_map()
+                                                .object());
+          return result;
+        }
+        break;
+      }
       case IrOpcode::kStoreField: {
         // We only care about StoreField of maps.
         Node* const object = GetValueInput(effect, 0);