[compiler] Remove invalid CHECK on mutable map bits

is_deprecated and is_stable are mutable and can be changed
concurrently.  We protect against changes through dependencies. CHECKs
on such fields are invalid.

Bug: v8:7790,chromium:1234206
Change-Id: I9bb7fab0342e0e2c33377c162b1912a8f93e760b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3059682
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75973}

src/compiler/access-info.cc

@@ -936,7 +936,6 @@ PropertyAccessInfo AccessInfoFactory::ComputePropertyAccessInfo(
 
     holder = prototype->AsJSObject();
     map = map_prototype_map;
-    CHECK(!map.is_deprecated());
 
     if (!CanInlinePropertyAccess(map, access_mode)) {
       return Invalid();
@@ -944,8 +943,12 @@ PropertyAccessInfo AccessInfoFactory::ComputePropertyAccessInfo(
 
     // Successful lookup on prototype chain needs to guarantee that all the
     // prototypes up to the holder have stable maps, except for dictionary-mode
-    // prototypes.
-    CHECK_IMPLIES(!map.is_dictionary_map(), map.is_stable());
+    // prototypes. We currently do this by taking a
+    // DependOnStablePrototypeChains dependency in the caller.
+    //
+    // TODO(jgruber): This is brittle and easy to miss. Consider a refactor
+    // that moves the responsibility of taking the dependency into
+    // AccessInfoFactory.
   }
   UNREACHABLE();
 }

src/compiler/js-native-context-specialization.cc

@@ -551,8 +551,9 @@ JSNativeContextSpecialization::InferHasInPrototypeChain(
       }
       map = map_prototype->map();
       // TODO(v8:11457) Support dictionary mode protoypes here.
-      if (!map.is_stable() || map.is_dictionary_map())
+      if (!map.is_stable() || map.is_dictionary_map()) {
         return kMayBeInPrototypeChain;
+      }
       if (map.oddball_type() == OddballType::kNull) {
         all = false;
         break;