[turbofan] Initial support for transitioning stores.

Add support for stores that transition to writable data fields,
based on the BeginRegion/FinishRegion mechanism for atomic regions
in the scheduler.

This is early work and still a bit rough around the edges, and similar
to regular stores, we don't support transitioning stores to double
fields yet.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1406153010

Cr-Commit-Position: refs/heads/master@{#31645}

src/compilation-dependencies.cc

@@ -106,6 +106,15 @@ void CompilationDependencies::Rollback() {
 }
 
 
+void CompilationDependencies::AssumeMapNotDeprecated(Handle<Map> map) {
+  DCHECK(!map->is_deprecated());
+  // Do nothing if the map cannot be deprecated.
+  if (map->CanBeDeprecated()) {
+    Insert(DependentCode::kTransitionGroup, map);
+  }
+}
+
+
 void CompilationDependencies::AssumeMapStable(Handle<Map> map) {
   DCHECK(map->is_stable());
   // Do nothing if the map cannot transition.

src/compilation-dependencies.h

@@ -32,6 +32,7 @@ class CompilationDependencies {
     Insert(DependentCode::kFieldTypeGroup, map);
   }
   void AssumeMapStable(Handle<Map> map);
+  void AssumeMapNotDeprecated(Handle<Map> map);
   void AssumePropertyCell(Handle<PropertyCell> cell) {
     Insert(DependentCode::kPropertyCellChangedGroup, cell);
   }

src/type-cache.h

@@ -60,7 +60,7 @@ class TypeCache final {
   // The JSArray::length property always contains a tagged number in the range
   // [0, kMaxUInt32].
   Type* const kJSArrayLengthType =
-      CreateNative(CreateRange(0.0, kMaxUInt32), Type::Tagged());
+      CreateNative(Type::Unsigned32(), Type::Tagged());
 
   // The String::length property always contains a smi in the range
   // [0, String::kMaxLength].