Revert of Provide a tagged allocation top pointer. (patchset #5 id:80001 of https://codereview.chromium.org/2028633002/ )

Reason for revert:
d8 segfaults on some benchmarks on ia32. Investigating.

Original issue's description:
> Provide a tagged allocation top pointer.
>
> Taking over http://crrev.com/1924223002.
>
> BUG=chromium:606711
> LOG=N
>
> Committed: https://crrev.com/f42c9e93c80fdf57e8f92bb87f6ed927d0ae4028
> Committed: https://crrev.com/c99caf307ba3bb1b1cf08bf4172f503754c41341
> Cr-Original-Commit-Position: refs/heads/master@{#36633}
> Cr-Commit-Position: refs/heads/master@{#36742}

TBR=bmeurer@chromium.org,hpayer@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:606711

Review-Url: https://codereview.chromium.org/2035413003
Cr-Commit-Position: refs/heads/master@{#36758}

Prior to this change, both 0 and 1 as RNG seed would result in the same
internal state. state0 and state1 cannot both be zero, but murmur hash
maps 0 back to 0.

R=cbruni@chromium.org
BUG=v8:5069

Review-Url: https://codereview.chromium.org/2040953002
Cr-Commit-Position: refs/heads/master@{#36757}

Improve CheckedLoad and Store bounds checking for arrays with power of two
length.

BUG=

Review-Url: https://codereview.chromium.org/2043663002
Cr-Commit-Position: refs/heads/master@{#36756}

R=rossberg,adamk
BUG=chromium:616386

Review-Url: https://codereview.chromium.org/2042793002
Cr-Commit-Position: refs/heads/master@{#36755}

[stubs] Introducing LoadICTFStub and LoadICTrampolineTFStub and a switch to enable them instead of respective platform stubs.

The stubs do not increase respective counters as they are in the snapshot and --native-code-counters is off during snapshot creation anyway.

Review-Url: https://codereview.chromium.org/2031753003
Cr-Commit-Position: refs/heads/master@{#36754}

This allows the header in question to be included without including any
other header files. This is step towards factory.h being self-contained.

R=clemensh@chromium.org

Review-Url: https://codereview.chromium.org/2043723002
Cr-Commit-Position: refs/heads/master@{#36752}

Since the generic GetCallingContext is deprecated, but there's still the
use case for the debugger to get the currently debugged context while in
the debug context, add a convenience API for it.

Note that EventDetails already exposes this context, but the embedder
might not necessarily have the EventDetails around.

R=verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2040853003
Cr-Commit-Position: refs/heads/master@{#36751}

Port 8d90210a

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:4483
LOG=N

Review-Url: https://codereview.chromium.org/2040803003
Cr-Commit-Position: refs/heads/master@{#36750}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com

BUG=

Review-Url: https://codereview.chromium.org/2043553002
Cr-Commit-Position: refs/heads/master@{#36749}

R=ahaas@chromium.org,aseemgarg@chromium.org,bradnelson@chromium.org
BUG=chromium:617525

Review-Url: https://codereview.chromium.org/2040983002
Cr-Commit-Position: refs/heads/master@{#36748}

BUG=chromium:617529

Review-Url: https://codereview.chromium.org/2041843002
Cr-Commit-Position: refs/heads/master@{#36747}

Passing in the isolate and pointer compare the instnance against the
corresponding constant is always faster than decoding the instance types.

BUG=

Review-Url: https://codereview.chromium.org/2028983002
Cr-Commit-Position: refs/heads/master@{#36744}

This makes sure {NodeProperties::FindFrameStateBefore} can deal with
effect chains that are marked as dead. This can happen when reducers
looking for frame states run together with other reducers killing some
execution paths within the same reduction phase.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-617567
BUG=chromium:617567,chromium:617224

Review-Url: https://codereview.chromium.org/2041833002
Cr-Commit-Position: refs/heads/master@{#36743}

Taking over http://crrev.com/1924223002.

BUG=chromium:606711
LOG=N

Committed: https://crrev.com/f42c9e93c80fdf57e8f92bb87f6ed927d0ae4028
Review-Url: https://codereview.chromium.org/2028633002
Cr-Original-Commit-Position: refs/heads/master@{#36633}
Cr-Commit-Position: refs/heads/master@{#36742}

[crankshaft] Fix DoDeferredMathAbsTaggedHeapNumber overwriting the context with some temporary value.

BUG=v8:5067

Review-Url: https://codereview.chromium.org/2033413002
Cr-Commit-Position: refs/heads/master@{#36738}

Previously, ZoneVector<MachineType>* printed just as a pointer; now we
print each MachineType in it, separated by commas.

BUG=

Review-Url: https://codereview.chromium.org/2030323002
Cr-Commit-Position: refs/heads/master@{#36736}

This removes the macro in question form the utility header. In the long
run we want to convert all RUNTIME_ASSERTs to CHECKs, now that runtime
functions are no longer fuzzed directly. This is just a first step.

R=bmeurer@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2038013002
Cr-Commit-Position: refs/heads/master@{#36735}

This is mostly about DCHECKs. Enabling some requires a few
changes to tests that were not careful about types.

BUG=

Review-Url: https://codereview.chromium.org/2033703002
Cr-Commit-Position: refs/heads/master@{#36734}

  port 8d90210a (r36718)

  original commit message:

BUG=

Review-Url: https://codereview.chromium.org/2039743002
Cr-Commit-Position: refs/heads/master@{#36728}

  port f2da19fe (r36703)

  original commit message:
  Introduce a dedicated Float64Log machine operator, that is either
  implemented by a direct C call or by platform specific code, i.e.
  using the FPU on x64 and ia32.

  This operator is used to implement Math.log as a proper TurboFan
  builtin on top of the CodeStubAssembler.

  Also introduce a NumberLog simplified operator on top of Float64Log
  and use that for the fast inline path of Math.log inside TurboFan
  optimized code.

BUG=

Review-Url: https://codereview.chromium.org/2034393002
Cr-Commit-Position: refs/heads/master@{#36727}

This change requires a single pass over the register set during
bytecode pipeline flushes.

A few bytecode tests are updated too because the order of register
flushes is different.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2033013002
Cr-Commit-Position: refs/heads/master@{#36726}

Port f2da19fe

Original commit message:

    Introduce a dedicated Float64Log machine operator, that is either
    implemented by a direct C call or by platform specific code, i.e.
    using the FPU on x64 and ia32.

    This operator is used to implement Math.log as a proper TurboFan
    builtin on top of the CodeStubAssembler.

    Also introduce a NumberLog simplified operator on top of Float64Log
    and use that for the fast inline path of Math.log inside TurboFan
    optimized code.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2033353003
Cr-Commit-Position: refs/heads/master@{#36724}

R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2037153002
Cr-Commit-Position: refs/heads/master@{#36723}

Make sure to flatten strings first in JSON.parse() builtins, otherwise
we always hit the slow path for non-sequential strings, i.e. for cons
strings.

Also don't create any arguments adaptor frames for JSON.parse() as the
C++ builtin can handle any number of inputs properly.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2039553002
Cr-Commit-Position: refs/heads/master@{#36722}

R=littledan@chromium.org
BUG=v8:5059

Review-Url: https://codereview.chromium.org/2033263002
Cr-Commit-Position: refs/heads/master@{#36721}

Port f2da19fe

Original commit message:

    Introduce a dedicated Float64Log machine operator, that is either
    implemented by a direct C call or by platform specific code, i.e.
    using the FPU on x64 and ia32.

    This operator is used to implement Math.log as a proper TurboFan
    builtin on top of the CodeStubAssembler.

    Also introduce a NumberLog simplified operator on top of Float64Log
    and use that for the fast inline path of Math.log inside TurboFan
    optimized code.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=v8:5065
LOG=N

Review-Url: https://codereview.chromium.org/2036273002
Cr-Commit-Position: refs/heads/master@{#36720}

Port 817b59c8

Adds instructions for MIPS to push float (single) and double registers.

LOG=N
BUG=v8:4124
TEST=cctest/test-run-native-calls/Float32Select_stack_params_return_reg,
cctest/test-run-native-calls/MixedParams_0, cctest/test-run-native-calls/MixedParams_1,
cctest/test-run-native-calls/MixedParams_2, cctest/test-run-native-calls/MixedParams_3

Review-Url: https://codereview.chromium.org/2038813002
Cr-Commit-Position: refs/heads/master@{#36719}

R=*bmeurer@chromium.org, caitpotter88@gmail.com, *littledan@chromium.org, *ulan@chromium.org
BUG=v8:4483

Review-Url: https://codereview.chromium.org/2033223003
Cr-Commit-Position: refs/heads/master@{#36718}

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2037943002
Cr-Commit-Position: refs/heads/master@{#36717}

This moves processing of jumps out of bytecode array builder and into
bytecode array writer. This simplifies the pipeline by avoiding having
to flush for offset and patch up offsets in bytecode array builder based
on what was emitted by the bytecode array writer.

This also enables future refactorings to add dead code elimination back
into the pipeline, and move processing of scalable operand sizes to the
end of the pipeline (in the bytecode array writer) rather than having to
deal with scalable operand types throughout pipeline.

BUG=v8:4280,chromium:616064

Review-Url: https://codereview.chromium.org/2035813002
Cr-Commit-Position: refs/heads/master@{#36716}

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2031873002
Cr-Commit-Position: refs/heads/master@{#36715}

- Adds names for float registers to RegisterConfiguration and uses them
when we have the MachineRepresentation.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2030143002
Cr-Commit-Position: refs/heads/master@{#36712}

This implements propagation of frame states from checkpoints to all
deoptimization points inserted by the EffectControlLinearizer. It also
allows us to remove the eager frame state input from all the checked
conversion operations.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2033143002
Cr-Commit-Position: refs/heads/master@{#36710}

R=titzer@chromium.org, bmeurer@chromium.org

BUG=v8:5065

Review-Url: https://codereview.chromium.org/2036143002
Cr-Commit-Position: refs/heads/master@{#36709}

Add intrinsics for IsSmi, IsTypedArray, IsRegExp and IsJSProxy,
all of which are intrinsics in Full-Codegen.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2034493002
Cr-Commit-Position: refs/heads/master@{#36707}

These speculative binary operators are simplified operators and should
not need a frame state themselves. These eager bailout points can by now
be found via checkpoints in the graph, whereas frame states attached to
nodes directly should always represent lazy bailout points.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2037673002
Cr-Commit-Position: refs/heads/master@{#36705}

  port 817b59c8 (r36654)

  original commit message:
  Adds instructions for ARM to push floats.

BUG=

Review-Url: https://codereview.chromium.org/2036773004
Cr-Commit-Position: refs/heads/master@{#36704}

Introduce a dedicated Float64Log machine operator, that is either
implemented by a direct C call or by platform specific code, i.e.
using the FPU on x64 and ia32.

This operator is used to implement Math.log as a proper TurboFan
builtin on top of the CodeStubAssembler.

Also introduce a NumberLog simplified operator on top of Float64Log
and use that for the fast inline path of Math.log inside TurboFan
optimized code.

BUG=v8:5065

Review-Url: https://codereview.chromium.org/2029413005
Cr-Commit-Position: refs/heads/master@{#36703}

  port 471893cc (r36649)

  original commit message:
  GenerateSmiToDouble on ia32 assumes that it is called from a JSFrame and can restore
  the context from the StandardFrameConstants::kContextObject. In the case of the
  interpreter it is called from a interpreter handler stub frame which doesn't
  push the context onto it's frame. Instead, push and pop esi to explicitly restore it
  correctly.

BUG=

Review-Url: https://codereview.chromium.org/2036083003
Cr-Commit-Position: refs/heads/master@{#36702}

  port 63ea3a50 (r36599)

  original commit message:
  Previously, we used the lowest bit for something else.

BUG=

Review-Url: https://codereview.chromium.org/2032063003
Cr-Commit-Position: refs/heads/master@{#36701}