[runtime][ic] Constant field tracking support.

test/mjsunit/compiler/concurrent-invalidate-transition-map.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 23 matching lines @@
 }
 
 function new_object() {
   var o = {};
   o.a = 1;
   o.b = 2;
   return o;
 }
 
 function add_field(obj) {
+  // Assign twice to make the field non-constant.
+  // TODO(ishell): update test once constant field tracking is done.
+  obj.c = 0;
   obj.c = 3;
 }
 var obj1 = new_object();
 var obj2 = new_object();
 add_field(obj1);
 add_field(obj2);
 %OptimizeFunctionOnNextCall(add_field, "concurrent");
 
 var o = new_object();
 // Kick off recompilation.
 add_field(o);
 // Invalidate transition map after compile graph has been created.
 o.c = 2.2;
 // In the mean time, concurrent recompiling is still blocked.
 assertUnoptimized(add_field, "no sync");
 // Let concurrent recompilation proceed.
 %UnblockConcurrentRecompilation();
 // Sync with background thread to conclude optimization that bailed out.
 assertUnoptimized(add_field, "sync");
 // Clear type info for stress runs.
 %ClearFunctionTypeFeedback(add_field);