Port r20746 (09f9176)
Original commit message:
This is an initial step towards tracking the exact types instead of just
the representations of fields. It adds support to track up to one map of
heap object field values, eliminating various map checks on values
loaded from such fields, at the cost of making stores to such fields
slightly more expensive.
Issues with transitioning stores and fast object literals in Crankshaft
fixed.
TEST=mjsunit/field-type-tracking
BUG=
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/238943002
Patch from Balazs Kilvady <kilvadyb@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
4cbbf0ae83