[runtime][ic] Constant field tracking support.

test/mjsunit/track-fields.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 245 matching lines @@
 assertEquals(1, smi20);
 assertEquals(1.5, dbl20);
 assertEquals(some_object20, obj20);
 
 assertEquals(100, o20.smi);
 assertEquals(100, o20.dbl);
 assertEquals(100, o20.dbl);
 
 function attr_mismatch_obj(v, writable) {
   var o = {};
+  // Assign twice to make the field non-constant.
+  // TODO(ishell): update test once constant field tracking is done.
+  o.some_value = 0;
   o.some_value = v;
   Object.defineProperty(o, "second_value", {value:10, writable:writable});
   return o;
 }
 
 function is_writable(o, p) {
   return Object.getOwnPropertyDescriptor(o,p).writable;
 }
 
 var writable = attr_mismatch_obj(10, true);
@@ skipping 121 matching lines @@
   var o = {"s_to_t":18};
   o.s_to_t = a;
   return o;
 }
 
 var st1 = smi_to_object(true);
 var st2 = smi_to_object(false);
 assertTrue(%HaveSameMap(st1, st2));
 assertEquals(true, st1.s_to_t);
 assertEquals(false, st2.s_to_t);