[turbofan] Initial support for monomorphic/polymorphic property stores.

This slightly generalizes the current mechnanism for property loads to
also deal with property stores (both monomorphic and polymorphic). It's
still somewhat adhoc, but it already handles a lot of the interesting
cases. We might want to wait for keyed accesses before we start
refactoring to a more general solution.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1422573002

Cr-Commit-Position: refs/heads/master@{#31475}

src/compiler/js-native-context-specialization.h

@@ -50,6 +50,7 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   Reduction ReduceJSLoadGlobal(Node* node);
   Reduction ReduceJSStoreGlobal(Node* node);
   Reduction ReduceJSLoadNamed(Node* node);
+  Reduction ReduceJSStoreNamed(Node* node);
 
   Reduction Replace(Node* node, Node* value, Node* effect = nullptr,
                     Node* control = nullptr) {
@@ -58,10 +59,13 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   }
   Reduction Replace(Node* node, Handle<Object> value);
 
+  enum PropertyAccessMode { kLoad, kStore };
   class PropertyAccessInfo;
   bool ComputePropertyAccessInfo(Handle<Map> map, Handle<Name> name,
+                                 PropertyAccessMode access_mode,
                                  PropertyAccessInfo* access_info);
   bool ComputePropertyAccessInfos(MapHandleList const& maps, Handle<Name> name,
+                                  PropertyAccessMode access_mode,
                                   ZoneVector<PropertyAccessInfo>* access_infos);
 
   struct ScriptContextTableLookupResult;