[turbofan] Always install code dependency when optimizing a store to global property.

The reason is that non-configurability still allows a writable property to become read-only.

BUG=chromium:663750

Review-Url: https://codereview.chromium.org/2508873002
Cr-Commit-Position: refs/heads/master@{#41029}

src/compiler/js-global-object-specialization.cc

@@ -225,14 +225,9 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
       break;
     }
     case PropertyCellType::kMutable: {
-      // Store to non-configurable, data property on the global can be lowered
-      // to a field store, even without recording a code dependency on the cell,
-      // because the property cannot be deleted or reconfigured to an accessor
-      // or interceptor property.
-      if (property_details.IsConfigurable()) {
-        // Protect lowering by recording a code dependency on the cell.
-        dependencies()->AssumePropertyCell(property_cell);
-      }
+      // Record a code dependency on the cell, and just deoptimize if the
+      // property ever becomes read-only.
+      dependencies()->AssumePropertyCell(property_cell);
       effect = graph()->NewNode(
           simplified()->StoreField(ForPropertyCellValue(
               MachineRepresentation::kTagged, Type::NonInternal(), name)),

test/mjsunit/regress/regress-crbug-663750.js

@@ -11,11 +11,11 @@ function foo(a) {
 this.x = 0;
 delete x;
 
-foo(1);
-foo(2);
+foo();
+foo();
 %OptimizeFunctionOnNextCall(foo);
-foo(3);
-assertEquals(3, v);
+foo();
+assertEquals(undefined, v);
 
 Object.freeze(this);
 
@@ -23,4 +23,4 @@ foo(4);
 foo(5);
 %OptimizeFunctionOnNextCall(foo);
 foo(6);
-assertEquals(3, v);
+assertEquals(undefined, v);