Reland "[turbofan] Polymorphic inlining - try merge map check dispatch with...

Reland "[turbofan] Polymorphic inlining - try merge map check dispatch with function call dispatch."

This reverts commit 57af6811.

This adds the checkpoint between the call and the polymorphic load.
I thought that JSCall with constant target cannot cause eager deopt,
but Canary seems to disagree (http://crbug.com/718019).

Bug: v8:5267,chromium:718019
Change-Id: I552b850db6beb93e733b371ad0e7204513da1dc4
Reviewed-on: https://chromium-review.googlesource.com/622867Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47521}

src/compiler/js-inlining-heuristic.h

@@ -64,6 +64,17 @@ class JSInliningHeuristic final : public AdvancedReducer {
   // Dumps candidates to console.
   void PrintCandidates();
   Reduction InlineCandidate(Candidate const& candidate, bool force_inline);
+  void CreateOrReuseDispatch(Node* node, Node* callee,
+                             Candidate const& candidate, Node** if_successes,
+                             Node** calls, Node** inputs, int input_count);
+  bool TryReuseDispatch(Node* node, Node* callee, Candidate const& candidate,
+                        Node** if_successes, Node** calls, Node** inputs,
+                        int input_count);
+  enum StateCloneMode { kCloneState, kChangeInPlace };
+  Node* DuplicateFrameStateAndRename(Node* frame_state, Node* from, Node* to,
+                                     StateCloneMode mode);
+  Node* DuplicateStateValuesAndRename(Node* state_values, Node* from, Node* to,
+                                      StateCloneMode mode);
 
   CommonOperatorBuilder* common() const;
   Graph* graph() const;