[turbofan] Support lazy deopt for truncating store to a typed array.

[turbofan] Support lazy deopt for truncating store to a typed array.

The change introduces a second frame state (for the state before
the operation) for the StoreProperty nodes. If the store writes
into a typed array, the frame state is used for lazy deopt from
the to-number conversion that is performed by the store.

BUG=v8:3963
LOG=n
R=bmeurer@chromium.org

Committed: https://crrev.com/0cde253c9efc0b0a362ea8c1a52fe408aa2a142c
Cr-Commit-Position: refs/heads/master@{#27285}

[Jarin, 2015-03-18 16:30:12]

Could you take a look, please?

[Benedikt Meurer, 2015-03-19 05:14:35]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-03-19 05:14:35]

lgtm

[commit-bot: I haz the power, 2015-03-19 05:15:13]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/997983004/40001

[commit-bot: I haz the power, 2015-03-19 05:46:28]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2015-03-19 05:46:40]

Patchset 3 (id:??) landed as
https://crrev.com/0cde253c9efc0b0a362ea8c1a52fe408aa2a142c
Cr-Commit-Position: refs/heads/master@{#27285}