Port r20746 (09f9176)

Original commit message:
This is an initial step towards tracking the exact types instead of just
the representations of fields. It adds support to track up to one map of
heap object field values, eliminating various map checks on values
loaded from such fields, at the cost of making stores to such fields
slightly more expensive.

Issues with transitioning stores and fast object literals in Crankshaft
fixed.

TEST=mjsunit/field-type-tracking
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/238943002

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00