When going to PREMONOMORPHIC state we previously stored the
premonomorphic sentinel into the first IC slot and then the
second slot was storing the uninitialized sentinel. So when
TurboFan kicked in and optimized the function we'd just put
a LOAD_IC in there and hoped for the best that this is either
not in hot code or will reoptimize for another reason later
to fixup the LOAD_IC.

This is a quite annoying footgun for developers because the
performance inevitably depends on timing of when the optimizing
compiler kicks in.

To fix this issue we now keep a weak reference to the receiver
map in the second slot of the IC in PREMONOMORPHIC state and
use that to speculatively optimize when we go to TurboFan. This
improves the performance on the reported bug from

  spread: 2342 ms.
  spread: 2352 ms.
  spread: 2339 ms.

to

  spread: 1490 ms.
  spread: 1451 ms.
  spread: 1445 ms.

which corresponds to a 36% improvement in this particular case.
In general you'll get more predictable performance with this
change.

We might want to also use the map when going to MONOMORPHIC
state at a later point to maybe skip the additional transition
to POLYMORPHIC in some cases, but that's independent of this
bug.

Bug: v8:5267, v8:7973
Change-Id: Ia4eef7651e219a40927531cdffe320ade1dd19a4
Reviewed-on: https://chromium-review.googlesource.com/1148205Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54682}