[turbofan] Use unreliable LOAD_IC feedback for Array.prototype.push.

src/compiler/js-inlining.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-inlining.h"
 
 #include "src/ast/ast.h"
 #include "src/compilation-info.h"
 #include "src/compiler.h"
 #include "src/compiler/all-nodes.h"
@@ skipping 294 matching lines @@
     case IrOpcode::kJSCreateKeyValueArray:
     case IrOpcode::kJSCreateLiteralArray:
     case IrOpcode::kJSCreateLiteralObject:
     case IrOpcode::kJSCreateLiteralRegExp:
     case IrOpcode::kJSConvertReceiver:
     case IrOpcode::kJSGetSuperConstructor:
     case IrOpcode::kJSToObject: {
       return false;
     }
     default: {
+      // We don't really care about the exact maps here, just the instance
+      // types, which don't change across potential side-effecting operations.
       ZoneHandleSet<Map> maps;
-      if (NodeProperties::InferReceiverMaps(receiver, effect, &maps)) {
+      NodeProperties::InferReceiverMapsResult result =
+          NodeProperties::InferReceiverMaps(receiver, effect, &maps);
+      if (result != NodeProperties::kNoReceiverMaps) {
         // Check if all {maps} are actually JSReceiver maps.
         for (size_t i = 0; i < maps.size(); ++i) {
           if (!maps[i]->IsJSReceiverMap()) return true;
         }
         return false;
       }
       return true;
     }
   }
 }
@@ skipping 399 matching lines @@
 
 CommonOperatorBuilder* JSInliner::common() const { return jsgraph()->common(); }
 
 SimplifiedOperatorBuilder* JSInliner::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8