Reland "[turbofan] Polymorphic inlining - try merge map check dispatch with function call dispatch."

This reverts commit 57af6811.

This adds the checkpoint between the call and the polymorphic load.
I thought that JSCall with constant target cannot cause eager deopt,
but Canary seems to disagree (http://crbug.com/718019).

Bug: v8:5267,chromium:718019
Change-Id: I552b850db6beb93e733b371ad0e7204513da1dc4
Reviewed-on: https://chromium-review.googlesource.com/622867Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47521}