[turbofan] Try to update deprecated maps first.

When optimizing stores to data properties in literals, we need to first
migrate deprecated maps before we lookup the property access infos for
those.

BUG=chromium:724608
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2930433003
Cr-Commit-Position: refs/heads/master@{#45727}

src/compiler/js-native-context-specialization.cc

@@ -1881,6 +1881,8 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
   }
 
   Handle<Map> receiver_map(map, isolate());
+  if (!Map::TryUpdate(receiver_map).ToHandle(&receiver_map)) return NoChange();
+
   Handle<Name> cached_name =
       handle(Name::cast(nexus.GetFeedbackExtra()), isolate());
 

test/mjsunit/regress/regress-crbug-724608.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return {['p']: 0, x};
+}
+foo();
+var a = {['p']: ''};
+%OptimizeFunctionOnNextCall(foo);
+foo();