[turbofan] Lower access to special JSObject field accessors.

[turbofan] Lower access to special JSObject field accessors.

This adds support to also optimize loads from special JSObject field
accessors, like String::length and JSArray::length.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/a5d4608e09981c7caebd364bfc57621857b8d05d
Cr-Commit-Position: refs/heads/master@{#31365}

[Benedikt Meurer, 2015-10-19 09:24:52]

Hey Jaro,

This is the support for missing "internal" object fields.
Please take a look.

Thanks,
Benedikt

[Jarin, 2015-10-19 09:32:04]

lgtm

[Benedikt Meurer, 2015-10-19 10:23:13]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2015-10-19 10:23:21]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1417503002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1417503002/1

[commit-bot: I haz the power, 2015-10-19 10:57:54]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-10-19 10:58:20]

Patchset 1 (id:??) landed as
https://crrev.com/a5d4608e09981c7caebd364bfc57621857b8d05d
Cr-Commit-Position: refs/heads/master@{#31365}