Reland "Ship constant field tracking"

This is a reland of 78ed0e3f

The breakage was unrelated to constant field tracking (see
the linked bugs).

Original change's description:
> Ship constant field tracking
>
> Bug: v8:8361
> Change-Id: I25c52c708517cf27add89e0c5c97e6d21abb2a9a
> Reviewed-on: https://chromium-review.googlesource.com/c/1456089
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59415}

Bug: v8:8361, v8:8799, v8:8801
Change-Id: I318768b925f3efd285cb27aa93e6de35fdcced42
Reviewed-on: https://chromium-review.googlesource.com/c/1458238Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59440}

src/flag-definitions.h

@@ -992,9 +992,9 @@ DEFINE_BOOL(trace_ic, false,
 DEFINE_IMPLICATION(trace_ic, log_code)
 DEFINE_INT(ic_stats, 0, "inline cache state transitions statistics")
 DEFINE_VALUE_IMPLICATION(trace_ic, ic_stats, 1)
-DEFINE_BOOL_READONLY(track_constant_fields, false,
+DEFINE_BOOL_READONLY(track_constant_fields, true,
                      "enable constant field tracking")
-DEFINE_BOOL_READONLY(modify_map_inplace, false, "enable in-place map updates")
+DEFINE_BOOL_READONLY(modify_map_inplace, true, "enable in-place map updates")
 DEFINE_BOOL_READONLY(fast_map_update, false,
                      "enable fast map update by caching the migration target")
 DEFINE_INT(max_polymorphic_map_count, 4,

test/mjsunit/mjsunit.status

@@ -306,6 +306,13 @@
   # BUG(v8:4237)
   'regress/regress-3976': [SKIP],
 
+  # BUG(v8:8799): Bytecode flushing breaks tagged template literals
+  'es6/templates': [SKIP],
+
+  # BUG(v8:8801): Bytecode flushing interacts poorly with assertOptimized
+  'regress/regress-7254': [SKIP],
+  'array-push5': [SKIP],
+
   # Slow tests.
   'array-constructor': [PASS, SLOW],
   'json': [PASS, SLOW],