[turbofan] Initial support for monomorphic/polymorphic property loads.

src/compiler/js-inlining.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-inlining.h"
 
 #include "src/ast.h"
 #include "src/ast-numbering.h"
 #include "src/compiler.h"
 #include "src/compiler/all-nodes.h"
@@ skipping 350 matching lines @@
     GraphReducer graph_reducer(local_zone_, &graph, jsgraph.Dead());
     DeadCodeElimination dead_code_elimination(&graph_reducer, &graph,
                                               jsgraph.common());
     CommonOperatorReducer common_reducer(&graph_reducer, &graph,
                                          jsgraph.common(), jsgraph.machine());
     JSGlobalSpecialization global_specialization(
         &graph_reducer, &jsgraph,
         info.is_deoptimization_enabled()
             ? JSGlobalSpecialization::kDeoptimizationEnabled
             : JSGlobalSpecialization::kNoFlags,
-        handle(info.global_object(), info.isolate()), info_->dependencies());
+        handle(info.global_object(), info.isolate()), info_->dependencies(),
+        local_zone_);
     graph_reducer.AddReducer(&dead_code_elimination);
     graph_reducer.AddReducer(&common_reducer);
     graph_reducer.AddReducer(&global_specialization);
     graph_reducer.ReduceGraph();
   }
 
   // The inlinee specializes to the context from the JSFunction object.
   // TODO(turbofan): We might want to load the context from the JSFunction at
   // runtime in case we only know the SharedFunctionInfo once we have dynamic
   // type feedback in the compiler.
@@ skipping 21 matching lines @@
 
   // Remember that we inlined this function.
   info_->AddInlinedFunction(info.shared_info());
 
   return InlineCall(node, context, frame_state, start, end);
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8