DFG folding of PutById to SimpleReplace should consider the specialized function...

DFG folding of PutById to SimpleReplace should consider the specialized function case
https://bugs.webkit.org/show_bug.cgi?id=113093

Reviewed by Geoffrey Garen and Mark Hahnenberg.

Source/JavaScriptCore:

* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeFor):

LayoutTests:

* fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function-expected.txt: Added.
* fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.js: Added.
(foo):
(baz):
(fuzz):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@146653 268f45cc-cd09-0410-ab3c-d52691b4dbfc