We should implement inline caching for property lookups.

The basic idea is to use the shape system to cache the "location" of properties the first time we execute a non-computed MemberExpression, and then reuse that location on subsequent executions.

This isn't entirely trivial of course, since JavaScript is a dynamic language where you can replace somebody's prototype's prototype etc, so this does need some extra validation and deoptimization logic.

Basically:

• If a property turns out to be an own property, remember the current shape. If the shape hasn't changed next time we execute the same MemberExpression, we can find the property in the same location. See this blog post for inspiration.
• Caching prototype accesses is less straightforward. There are a number of approaches to this. See for example this other blog post that explains how V8 does this.