[turbofan] Try updating maps early on.

Then the various methods that take receiver maps don't need to
worry about deprecated maps.

Change-Id: I09c53939275b1af19d54430bfecb23809a4257c2
Reviewed-on: https://chromium-review.googlesource.com/c/1458243Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59496}

src/compiler/access-info.cc

@@ -290,12 +290,10 @@ bool AccessInfoFactory::ComputeElementAccessInfos(
   MapHandles possible_transition_targets;
   possible_transition_targets.reserve(maps.size());
   for (Handle<Map> map : maps) {
-    if (Map::TryUpdate(isolate(), map).ToHandle(&map)) {
-      if (CanInlineElementAccess(map) &&
-          IsFastElementsKind(map->elements_kind()) &&
-          GetInitialFastElementsKind() != map->elements_kind()) {
-        possible_transition_targets.push_back(map);
-      }
+    if (CanInlineElementAccess(map) &&
+        IsFastElementsKind(map->elements_kind()) &&
+        GetInitialFastElementsKind() != map->elements_kind()) {
+      possible_transition_targets.push_back(map);
     }
   }
 
@@ -304,18 +302,16 @@ bool AccessInfoFactory::ComputeElementAccessInfos(
   receiver_maps.reserve(maps.size());
   std::vector<std::pair<Handle<Map>, Handle<Map>>> transitions(maps.size());
   for (Handle<Map> map : maps) {
-    if (Map::TryUpdate(isolate(), map).ToHandle(&map)) {
-      // Don't generate elements kind transitions from stable maps.
-      Map transition_target = map->is_stable()
-                                  ? Map()
-                                  : map->FindElementsKindTransitionedMap(
-                                        isolate(), possible_transition_targets);
-      if (transition_target.is_null()) {
-        receiver_maps.push_back(map);
-      } else {
-        transitions.push_back(
-            std::make_pair(map, handle(transition_target, isolate())));
-      }
+    // Don't generate elements kind transitions from stable maps.
+    Map transition_target = map->is_stable()
+                                ? Map()
+                                : map->FindElementsKindTransitionedMap(
+                                      isolate(), possible_transition_targets);
+    if (transition_target.is_null()) {
+      receiver_maps.push_back(map);
+    } else {
+      transitions.push_back(
+          std::make_pair(map, handle(transition_target, isolate())));
     }
   }
 
@@ -572,13 +568,11 @@ bool AccessInfoFactory::ComputePropertyAccessInfos(
   ZoneVector<PropertyAccessInfo> infos(zone());
   infos.reserve(maps.size());
   for (Handle<Map> map : maps) {
-    if (Map::TryUpdate(isolate(), map).ToHandle(&map)) {
-      PropertyAccessInfo access_info;
-      if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
-        return false;
-      }
-      infos.push_back(access_info);
+    PropertyAccessInfo access_info;
+    if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
+      return false;
     }
+    infos.push_back(access_info);
   }
 
   // Merge as many as possible and push into {access_infos}.

src/compiler/js-native-context-specialization.cc

@@ -3128,6 +3128,19 @@ bool JSNativeContextSpecialization::CanTreatHoleAsUndefined(
   return true;
 }
 
+namespace {
+void TryUpdateThenDropDeprecated(Isolate* isolate, MapHandles* maps) {
+  for (auto it = maps->begin(); it != maps->end();) {
+    if (Map::TryUpdate(isolate, *it).ToHandle(&*it)) {
+      DCHECK(!(*it)->is_deprecated());
+      ++it;
+    } else {
+      it = maps->erase(it);
+    }
+  }
+}
+}  // namespace
+
 bool JSNativeContextSpecialization::ExtractReceiverMaps(
     Node* receiver, Node* effect, FeedbackNexus const& nexus,
     MapHandles* receiver_maps) {
@@ -3142,7 +3155,7 @@ bool JSNativeContextSpecialization::ExtractReceiverMaps(
     bool use_inference =
         !IsKeyedStoreICKind(kind) && !IsStoreInArrayLiteralICKind(kind);
     if (use_inference && InferReceiverMaps(receiver, effect, receiver_maps)) {
-      // We can assume that {receiver} still has the inferred {receiver_maps}.
+      TryUpdateThenDropDeprecated(isolate(), receiver_maps);
       return true;
     }
   }
@@ -3162,6 +3175,7 @@ bool JSNativeContextSpecialization::ExtractReceiverMaps(
                          }),
           receiver_maps->end());
     }
+    TryUpdateThenDropDeprecated(isolate(), receiver_maps);
     return true;
   }
 

src/compiler/js-native-context-specialization.h

@@ -208,9 +208,6 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
                            MapHandles* receiver_maps);
 
   // Try to infer maps for the given {receiver} at the current {effect}.
-  // If maps are returned then you can be sure that the {receiver} definitely
-  // has one of the returned maps at this point in the program (identified
-  // by {effect}).
   bool InferReceiverMaps(Node* receiver, Node* effect,
                          MapHandles* receiver_maps);
   // Try to infer a root map for the {receiver} independent of the current