Port r16098 (328ff5f7)

Original commit message:
This change implements a simple data-flow analysis pass over captured
objects to the existing escape analysis. It tracks the state of values
in the Hydrogen graph through CapturedObject marker instructions that
are used to construct an appropriate translation for the deoptimizer to
be able to materialize these objects again.

This can be considered a combination of scalar replacement of loads and
stores on captured objects and sinking of unused allocations.

TEST=mjsunit/compiler/escape-analysis

BUG=

Review URL: https://codereview.chromium.org/22580003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16107 ce2b1a6d-e550-0410-aec6-3dcde31c8c00