[turbofan] Restore fast API calls with no receiver knowledge.

When TurboFan doesn't know anything about the receiver, it will
generally insert a call via CallFunctionTemplate builtin, which
does all the necessary checks. For this we don't need to be able
to deoptimize, so there's no need to have the speculation bit

This restores the performance in the case of calling API methods
and accessors via `Function#call()`, i.e. like in this example:

const hasAttribute = Element.prototype.hasAttribute;
// ...
hasAttribute.call(element, "bar");

Bug: v8:8820
Change-Id: Ic30719d7db75141023efc11d76180b001f871d28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1615248
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61604}
diff --git a/src/compiler/js-call-reducer.cc b/src/compiler/js-call-reducer.cc
index cd70e44..d6544b9 100644
--- a/src/compiler/js-call-reducer.cc
+++ b/src/compiler/js-call-reducer.cc
@@ -2737,10 +2737,6 @@
     Node* node, const SharedFunctionInfoRef& shared) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
-  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
-    return NoChange();
-  }
   int const argc = static_cast<int>(p.arity()) - 2;
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* global_proxy =
@@ -2807,6 +2803,12 @@
       if (!api_holder.is_identical_to(holderi)) return inference.NoChange();
+    // We may need to check {receiver_maps} again below, so better
+    // make sure we are allowed to speculate in this case.
+    if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+      return inference.NoChange();
+    }
     // TODO(neis): The maps were used in a way that does not actually require
     // map checks or stability dependencies.
     inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,