Revert of Only use FreeSpace objects in the free list. (patchset #3 id:40001 of https://codereview.chromium.org/876613002/)

Reason for revert:
Test failures

Original issue's description:
> Only use FreeSpace objects in the free list.
>
> This solves an issue with the custom startup snapshot, in cases where
> deserializing the isolate requires more than one page per space.
>
> R=hpayer@chromium.org
>
> Committed: https://crrev.com/66964395108f03220cb6f45ddc73c5965e2c76a9
> Cr-Commit-Position: refs/heads/master@{#26285}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/882443004

Cr-Commit-Position: refs/heads/master@{#26287}

This solves an issue with the custom startup snapshot, in cases where
deserializing the isolate requires more than one page per space.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/876613002

Cr-Commit-Position: refs/heads/master@{#26285}

BUG=

Review URL: https://codereview.chromium.org/862923002

Cr-Commit-Position: refs/heads/master@{#26237}

This prevents GC from observing code objects with out-of-sync weak dependencies.

BUG=v8:3823
LOG=N

Review URL: https://codereview.chromium.org/866723002

Cr-Commit-Position: refs/heads/master@{#26225}

Use std::numeric_limits<double>::quiet_NaN() and
std::numeric_limits<float>::quiet_NaN() instead.

Review URL: https://codereview.chromium.org/864803002

Cr-Commit-Position: refs/heads/master@{#26195}

TEST=mjsunit,cctest,unittests
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/863633002

Cr-Commit-Position: refs/heads/master@{#26180}

PropertyKind:
  DATA -> kData
  ACCESSOR -> kAccessor

PropertyType:
  FIELD -> DATA
  CONSTANT -> DATA_CONSTANT
  ACCESSOR_FIELD -> ACCESSOR
  CALLBACKS -> ACCESSOR_CONSTANT

PropertyLocation:
  IN_OBJECT -> kField
  IN_DESCRIPTOR -> kDescriptor

StoreMode:
  FORCE_IN_OBJECT -> FORCE_FIELD

FieldDescriptor -> DataDescriptor
ConstantDescriptor -> DataConstantDescriptor
CallbacksDescriptor -> AccessorConstantDescriptor

Review URL: https://codereview.chromium.org/856503002

Cr-Commit-Position: refs/heads/master@{#26146}

BUG=

Review URL: https://codereview.chromium.org/855903002

Cr-Commit-Position: refs/heads/master@{#26129}

Math functions:
Some Math functions require typed arrays for their implementation. The embedded
script may call those Math functions. The serializer needs to deal with this.
Added assertion to make sure no other typed array is created when snapshotting.

Number-string cache:
We assume that the initial snapshot does not expand the number-string cache.
This is no longer true for custom heap snapshots.

Bound functions:
Bound functions store the bound arguments in a COW fixed array, including the
bindee function. COW arrays are serialized into the startup snapshot and
referenced in the partial snapshot via partial snapshot cache. However, the
bindee function is context-dependent and must not be part of the startup
snapshot. There is no need for bound functions to use a COW array though.

R=jochen@chromium.org

Review URL: https://codereview.chromium.org/851073002

Cr-Commit-Position: refs/heads/master@{#26072}

Instead, just use DCHECKs. The builders that want them in release mode
should already be useding dcheck_always_on anyways

BUG=none
R=machenbach@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/841083002

Cr-Commit-Position: refs/heads/master@{#26001}

R=jochen@chromium.org

BUG=

Review URL: https://codereview.chromium.org/834443004

Cr-Commit-Position: refs/heads/master@{#25981}

This is not needed anymore since all ICs use weak cells to embed maps.

BUG=v8:3629
LOG=N

Review URL: https://codereview.chromium.org/817223003

Cr-Commit-Position: refs/heads/master@{#25928}

There are no users of this infrastructure yet, so it's behind an off-by-default flag.

Review URL: https://codereview.chromium.org/768633002

Cr-Commit-Position: refs/heads/master@{#25829}

LayoutDescriptorHelper is now able to calculate the length of contiguous regions of tagged/non-tagged fields.
This functionality is now used by both object visitor and store buffer.

TEST=cctest/test-unboxed-doubles

Review URL: https://codereview.chromium.org/726713003

Cr-Commit-Position: refs/heads/master@{#25816}

Review URL: https://codereview.chromium.org/801813002

Cr-Commit-Position: refs/heads/master@{#25802}

FINAL implies OVERRIDE, which in turn implies virtual, so there's no need to use
more than one of these. The Google C++ style guide even requires this, see
http://google-styleguide.googlecode.com/svn/trunk/cppguide.html#Inheritance.

While we're here, port r24662 to x87.

The net result is that v8 compiles again with a current clang.

BUG=v8:3753
LOG=y

Review URL: https://codereview.chromium.org/797943002

Cr-Commit-Position: refs/heads/master@{#25792}

They both now run fast (due to utilizing transitions instead of always
creating new maps) and sealed or non-extensible objects can stay in
fast mode after transitioning.

This almost entirely reuses the code for transitioning objects
frozen by Object.freeze(), with the added benefit of freeing
up a bit on the map (we no longer keep track of frozen-ness,
as that bit wasn't used for anything interesting).

BUG=v8:3662,chromium:115960
LOG=y

Review URL: https://codereview.chromium.org/776143005

Cr-Commit-Position: refs/heads/master@{#25759}

Reland of "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name."

Review URL: https://codereview.chromium.org/793453004

Cr-Commit-Position: refs/heads/master@{#25750}

TBR=jkummerow@chromium.org

BUG=

Review URL: https://codereview.chromium.org/794563002

Cr-Commit-Position: refs/heads/master@{#25744}

R=jkummerow@chromium.org
BUG=433458
LOG=N

Review URL: https://codereview.chromium.org/759683004

Cr-Commit-Position: refs/heads/master@{#25737}

BUG=none
TBR=rossberg@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/788603002

Cr-Commit-Position: refs/heads/master@{#25702}

When compiling with the macro DCHECK_ALWAYS_ON defined, DCHECKs and
supporting code gets compiled and enabled.

This increases test coverage for chromium release buildbots

BUG=v8:3731
R=jkummerow@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/760213005

Cr-Commit-Position: refs/heads/master@{#25701}

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/783913003

Cr-Commit-Position: refs/heads/master@{#25699}

This combines Map::DoneInobjectSlackTracking and Map::ConstructionCount into one more generic 4-bit counter.

Counter values from 15 down to 8 are used for in-object slack tracking, values from 7 down to 0 are free to be used for a new counter when in-object slack tracking is inactive.

Review URL: https://codereview.chromium.org/767253002

Cr-Commit-Position: refs/heads/master@{#25689}

This relands macroassembler instructions and weak cell caching and
does not include parts that caused "Linux ASan LSan" test failures.

BUG=v8:3663
LOG=N

Review URL: https://codereview.chromium.org/764003003

Cr-Commit-Position: refs/heads/master@{#25615}

Revert of Use weak cells in map checks in polymorphic ICs. (patchset #8 id:140001 of https://codereview.chromium.org/753993003/)

Reason for revert:
[Sheriff] Speculative revert for breaking chromium asan (roll blocker):
http://build.chromium.org/p/client.v8/builders/Linux%20ASan%20LSan%20Tests%20%281%29/builds/1683

Original issue's description:
> Use weak cells in map checks in polymorphic ICs.
>
> BUG=v8:3663
> LOG=N

TBR=mvstanton@chromium.org,akos.palfi@imgtec.com,weiliang.lin@intel.com,ulan@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3663

Review URL: https://codereview.chromium.org/771033003

Cr-Commit-Position: refs/heads/master@{#25597}

BUG=v8:3663
LOG=N

Review URL: https://codereview.chromium.org/753993003

Cr-Commit-Position: refs/heads/master@{#25581}

R=yangguo@chromium.org
LOG=N

BUG=437280

Review URL: https://codereview.chromium.org/769453002

Cr-Commit-Position: refs/heads/master@{#25562}

R=rossberg@chromium.org,arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/766663003

Cr-Commit-Position: refs/heads/master@{#25555}

Previously, a separate string to be hashed (in order to help determine the need to
use a cached Template Call Site) was built up by joining UTF8 spans within a template.

Now, the hash key is generated from the original spans, removing the need to allocate a new
buffer and copy bytes into it.

BUG=

Review URL: https://codereview.chromium.org/765473006

Cr-Commit-Position: refs/heads/master@{#25549}

a revival of https://codereview.chromium.org/467013003

R=rossberg@chromium.org

BUG=

Review URL: https://codereview.chromium.org/760883002

Cr-Commit-Position: refs/heads/master@{#25537}

BUG=chromium:436816
LOG=N

Review URL: https://codereview.chromium.org/765473004

Cr-Commit-Position: refs/heads/master@{#25535}

R=rmcilroy@chromium.org
BUG=chromium:436510
LOG=N
TEST=compile with V8_OOL_CONSTANT_POOL=1, run d8 with --verify-heap --test

Review URL: https://codereview.chromium.org/759823006

Cr-Commit-Position: refs/heads/master@{#25534}

R=yangguo@chromium.org

BUG=

Review URL: https://codereview.chromium.org/762773002

Cr-Commit-Position: refs/heads/master@{#25518}

R=mvstanton@chromium.org
BUG=chromium:436447

Review URL: https://codereview.chromium.org/756983003

Cr-Commit-Position: refs/heads/master@{#25504}

BUG=chromium:434447

Review URL: https://codereview.chromium.org/755173002

Cr-Commit-Position: refs/heads/master@{#25500}

Review URL: https://codereview.chromium.org/751643005

Cr-Commit-Position: refs/heads/master@{#25483}

Review URL: https://codereview.chromium.org/739013004

Cr-Commit-Position: refs/heads/master@{#25482}

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/737373003

Cr-Commit-Position: refs/heads/master@{#25444}

Due to performance issue.
TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/735323002

Cr-Commit-Position: refs/heads/master@{#25421}