Polymorphic IC feedback can contain up to four (map, handler) pairs.

HandlePolymorphicCase already unrolled checks for the first two pairs; these
are guaranteed to exist and can omit bound checks.

This CL unrolls checks against the final two pairs as well.

BUG=v8:5917

Review-Url: https://codereview.chromium.org/2728293005
Cr-Commit-Position: refs/heads/master@{#43650}