Revert of [turbofan] Fix and enable property stores.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index 907f915695a7f31fd5563fe6ad572181cab0a19d..28615e14628b6b6b60457a407ce6a5f4f29b9b1a 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -312,8 +312,7 @@
     Handle<Map> map, Handle<Name> name, PropertyAccessMode access_mode,
     PropertyAccessInfo* access_info) {
   MaybeHandle<JSObject> holder;
-  Handle<Map> receiver_map = map;
-  Type* receiver_type = Type::Class(receiver_map, graph()->zone());
+  Type* receiver_type = Type::Class(map, graph()->zone());
   while (CanInlinePropertyAccess(map)) {
     // Check for special JSObject field accessors.
     int offset;
@@ -357,9 +356,6 @@
     Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
     int const number = descriptors->SearchWithCache(*name, *map);
     if (number != DescriptorArray::kNotFound) {
-      if (access_mode == kStore && !map.is_identical_to(receiver_map)) {
-        return false;
-      }
       PropertyDetails const details = descriptors->GetDetails(number);
       if (details.type() == DATA_CONSTANT) {
         *access_info = PropertyAccessInfo::DataConstant(
@@ -368,14 +364,14 @@
         return true;
       } else if (details.type() == DATA) {
         // Don't bother optimizing stores to read-only properties.
-        if (access_mode == kStore && details.IsReadOnly()) {
+        if (access_mode == kStore) {
           break;
         }
         int index = descriptors->GetFieldIndex(number);
         Representation field_representation = details.representation();
         FieldIndex field_index = FieldIndex::ForPropertyIndex(
             *map, index, field_representation.IsDouble());
-        Type* field_type = Type::Tagged();
+        Type* field_type = Type::Any();
         if (field_representation.IsSmi()) {
           field_type = Type::Intersect(Type::SignedSmall(),
                                        Type::TaggedSigned(), graph()->zone());
@@ -458,13 +454,11 @@
     PropertyAccessMode access_mode,
     ZoneVector<PropertyAccessInfo>* access_infos) {
   for (Handle<Map> map : maps) {
-    if (Map::TryUpdate(map).ToHandle(&map)) {
-      PropertyAccessInfo access_info;
-      if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
-        return false;
-      }
-      access_infos->push_back(access_info);
-    }
+    PropertyAccessInfo access_info;
+    if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
+      return false;
+    }
+    access_infos->push_back(access_info);
   }
   return true;
 }
@@ -494,9 +488,7 @@
   if (!ComputePropertyAccessInfos(receiver_maps, name, kLoad, &access_infos)) {
     return NoChange();
   }
-
-  // Nothing to do if we have no non-deprecated maps.
-  if (access_infos.empty()) return NoChange();
+  DCHECK(!access_infos.empty());
 
   // The final states for every polymorphic branch. We join them with
   // Merge+Phi+EffectPhi at the bottom.
@@ -780,6 +772,7 @@
     // Determine actual holder and perform prototype chain checks.
     Handle<JSObject> holder;
     if (access_info.holder().ToHandle(&holder)) {
+      this_receiver = jsgraph()->Constant(holder);
       for (auto i = access_info.receiver_type()->Classes(); !i.Done();
            i.Advance()) {
         Handle<Map> map = i.Current();