If the CallIC collected a known target function for a callsite, add
a runtime check to ensure that the feedback remains the same and
specialize the JSCallFunction node to the known target function so that
inlining and typed lowering can pick up the feedback.

R=mstarzinger@chromium.org
BUG=v8:4470, v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1428923002

Cr-Commit-Position: refs/heads/master@{#31689}