[turbofan] Lower JSCreate to an inline allocation in JSTypedLowering.

src/compiler/access-builder.cc

Index: src/compiler/access-builder.cc
diff --git a/src/compiler/access-builder.cc b/src/compiler/access-builder.cc
index ac0be79225a1a8bae269cf712fab5afc09a5a695..3e513c0bd3ebd7a0d40dd67eba9a31f436823edf 100644
--- a/src/compiler/access-builder.cc
+++ b/src/compiler/access-builder.cc
@@ -48,6 +48,16 @@ FieldAccess AccessBuilder::ForJSObjectElements() {
 
 
 // static
+FieldAccess AccessBuilder::ForJSObjectInObjectProperty(Handle<Map> map,
+                                                       int index) {
+  int const offset = map->GetInObjectPropertyOffset(index);
+  FieldAccess access = {kTaggedBase, offset, MaybeHandle<Name>(),
+                        Type::Tagged(), kMachAnyTagged};
+  return access;
+}
+
+
+// static
 FieldAccess AccessBuilder::ForJSFunctionContext() {
   FieldAccess access = {kTaggedBase, JSFunction::kContextOffset,
                         MaybeHandle<Name>(), Type::Internal(), kMachAnyTagged};