Enforce correct number comparisons when inlining Array.indexOf.

TEST=mjsunit/regress/regress-crbug-407946
BUG=407946
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/536393003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Flatten property_kind into state. Add UNKNOWN as a state for dict-mode receivers

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/540903002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00