This patch includes the following changes.
     1, Enable the turbofan backend support for X87 platform. It depends on previous CL: 3fdfebd2.
     2, Enable the test cases which are disabled because turbofan for X87 was not enabled.

BUG=v8:4135
LOG=N

Review URL: https://codereview.chromium.org/1179763004

Cr-Commit-Position: refs/heads/master@{#29049}

frame->GetExpression always returns the same function. We should iterate through expression stack when we use Function.call.apply for finding actual target.

LOG=N
BUG=chromium:499479
R=yurys@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1182703003

Cr-Commit-Position: refs/heads/master@{#29048}

We use an alignment prefix for unusual alignment kinds (not kWordAligned).
This will cause new objects to be aligned in ReadObject, and back references
to be aligned to skip padding.

The motivation to change the undefined next sentinel in WeakCell is this:
When the deserializer aligns an object, it requires filler maps to already
exist to create filler objects as padding. However, deserializing the
filler map leads to deserializing NaN, which as heap number is aligned:
filler map > meta map > weak cell cache > undefined > NaN
If we use the-hole instead of undefined as sentinel, it works.

R=jochen@chromium.org,bbudge@chromium.org
BUG=v8:4178
LOG=N

Committed: https://crrev.com/2146ab75387d47eef6582bd8c2d0cfc6c42b68b6
Cr-Commit-Position: refs/heads/master@{#29044}

Review URL: https://codereview.chromium.org/1179873003

Cr-Commit-Position: refs/heads/master@{#29047}

Revert of Decompiler improvements. (patchset #2 id:20001 of https://codereview.chromium.org/1177123002/)

Reason for revert:
Code printout has become unreadable. Offsets are printed in decimal numbers everywhere else. This is inconsistent with the rest of the code-base. Some examples are tables for deoptimization data, safepoints and exception handlers. I would be fine with this change if _all_ tracing would be adapted. But there are _many_ places to touch.

Original issue's description:
> Decompiler improvements.
>
> The main motivation is simplifying profiling activities:
>
> 1) Use hex instead of decimal for offsets, just like perf does. This
> affects --print-opt-code
>
> 2) When printing block information, indicate loop information: if
> block is header, where the end is; if block is in a loop, where the
> loop starts. This affects --code-comments.
>
> Using --print-opt-code --code-comments, and cross-referencing with data
> obtained from perf, one may now find the block a hotspot belongs to
> without needing to do hex2dec/dec2hex conversions. Once found, loop info
> is available locally, on the block.
>
> BUG=
>
> Committed: https://crrev.com/32f4bd659d38eb5485eedb1d0dd236ff1bdc01d5
> Cr-Commit-Position: refs/heads/master@{#28964}

TBR=jarin@chromium.org,stichnot@chromium.org,jvoung@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1188093002

Cr-Commit-Position: refs/heads/master@{#29046}

Revert of Serializer: support all alignment kinds. (patchset #3 id:40001 of https://codereview.chromium.org/1179873003/)

Reason for revert:
[Sheriff] Breaks arm debug compile:
http://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20debug%20builder/builds/4308

Original issue's description:
> Serializer: support all alignment kinds.
>
> We use an alignment prefix for unusual alignment kinds (not kWordAligned).
> This will cause new objects to be aligned in ReadObject, and back references
> to be aligned to skip padding.
>
> The motivation to change the undefined next sentinel in WeakCell is this:
> When the deserializer aligns an object, it requires filler maps to already
> exist to create filler objects as padding. However, deserializing the
> filler map leads to deserializing NaN, which as heap number is aligned:
> filler map > meta map > weak cell cache > undefined > NaN
> If we use the-hole instead of undefined as sentinel, it works.
>
> R=jochen@chromium.org,bbudge@chromium.org
> BUG=v8:4178
> LOG=N
>
> Committed: https://crrev.com/2146ab75387d47eef6582bd8c2d0cfc6c42b68b6
> Cr-Commit-Position: refs/heads/master@{#29044}

TBR=jochen@chromium.org,bbudge@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4178

Review URL: https://codereview.chromium.org/1173253006

Cr-Commit-Position: refs/heads/master@{#29045}

We use an alignment prefix for unusual alignment kinds (not kWordAligned).
This will cause new objects to be aligned in ReadObject, and back references
to be aligned to skip padding.

The motivation to change the undefined next sentinel in WeakCell is this:
When the deserializer aligns an object, it requires filler maps to already
exist to create filler objects as padding. However, deserializing the
filler map leads to deserializing NaN, which as heap number is aligned:
filler map > meta map > weak cell cache > undefined > NaN
If we use the-hole instead of undefined as sentinel, it works.

R=jochen@chromium.org,bbudge@chromium.org
BUG=v8:4178
LOG=N

Review URL: https://codereview.chromium.org/1179873003

Cr-Commit-Position: refs/heads/master@{#29044}

BUG=chromium:500824
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1186333002

Cr-Commit-Position: refs/heads/master@{#29043}

This fixes warning on android_arm build.
Previously the compiler complained about a check that can never be true.
See second check below(index is size_t type, FIRST_SPACE=0):
if (index > i::LAST_SPACE || index < i::FIRST_SPACE)
And make the code easy to understand.

BUG=

Review URL: https://codereview.chromium.org/1155043005

Cr-Commit-Position: refs/heads/master@{#29042}

R=rossberg@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1182303004

Cr-Commit-Position: refs/heads/master@{#29041}

R=jochen@chromium.org
BUG=chromium:500435
LOG=y

Review URL: https://codereview.chromium.org/1183683004

Cr-Commit-Position: refs/heads/master@{#29040}

This is the first step towards unifying external and on-heap typed arrays.

The end-state will be that this base pointer either points to the on-heap values
or to the externally allocated array buffer.

BUG=v8:3996
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1176263004

Cr-Commit-Position: refs/heads/master@{#29039}

This invariant will save us some head ache.
The changes to test-debug/DebugStub is due to the fact that it abuses
the ability to set break points in code that has no debug break slots.
This is now no longer possible.

R=ulan@chromium.org
BUG=v8:4132
LOG=N

Review URL: https://codereview.chromium.org/1181013007

Cr-Commit-Position: refs/heads/master@{#29038}

Using TranslatedState and friends is too expensive compared to the low
level TranslationIterator, because some code (i.e. in Speedometer)
depends on the OptimizedFrame summary/function listing to be very fast.

BUG=chromium:499338
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1181373003

Cr-Commit-Position: refs/heads/master@{#29037}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1186573004

Cr-Commit-Position: refs/heads/master@{#29036}

Rolling v8/build/gyp to 79de4031069f37870f04e8b6bbf42f0c7fec37aa

Rolling v8/tools/clang to 66ba82eea5b4e2309c220cc3e0f2d67ebc3fff4c

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1187073008

Cr-Commit-Position: refs/heads/master@{#29035}

Fix a missed addiu->Addu, and a bad default use of 'at' register in https://codereview.chromium.org/1185143002/

TEST=test/mjsunit/regress/regress-500176
BUG=chromium:500176
LOG=N

Review URL: https://codereview.chromium.org/1187063002

Cr-Commit-Position: refs/heads/master@{#29034}

This patch implements %_IsTypedArray in fullcodegen, Hydrogen and
Turbofan in order to implement fast type checks to enable ES6
TypedArray features and semantics efficiently.

R=adamk,titzer
LOG=Y
BUG=v8:4085

Review URL: https://codereview.chromium.org/1183213002

Cr-Commit-Position: refs/heads/master@{#29033}

Computed property literals don't seem to work in nosnap yet,
leading to a syntax error.

R=adamk,arv

Review URL: https://codereview.chromium.org/1189643002

Cr-Commit-Position: refs/heads/master@{#29032}

In ES6, the TypedArray constructor can be called either with an
array-like object or an iterable. The code previously handled
only array-like objects. This patch switches to supporting
iterables while throwing in an optimization to make Arrays
get allocated the old way, without an extra copy.

BUG=v8:4090
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1181903003

Cr-Commit-Position: refs/heads/master@{#29031}

TEST=test/mjsunit/regress/regress-500176
BUG=chromium:500176
LOG=N

Review URL: https://codereview.chromium.org/1185143002

Cr-Commit-Position: refs/heads/master@{#29030}

R=arv@chromium.org,wingo@igalia.com,caitpotter88@gmail.com
LOG=N
BUG=v8:811

Review URL: https://codereview.chromium.org/1167393005

Cr-Commit-Position: refs/heads/master@{#29029}

The TryLowerDirectJSCall method tried to lower to a direct JavaScript
function call depending on the type of the receiver, but only if the
target is a cosntant JSFunction. Since this depends on types and is not
required for correctness, it shouldn't be part of generic lowering
anyway. So this functionality was moved to typed lowering instead, and
we use proper types for the target instead.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1182193005

Cr-Commit-Position: refs/heads/master@{#29028}

Reasons:
- It is not used.
- It complicates code in GC.

BUG=chromium:499713
LOG=NO

Review URL: https://codereview.chromium.org/1184723002

Cr-Commit-Position: refs/heads/master@{#29027}

R=arv@chromium.org, conradw@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1180943007

Cr-Commit-Position: refs/heads/master@{#29026}

This hack doesn't help currently, since it only applies to asm.js where
we do function context specialization and there we already have a
canonicalized context (and the CodeGenerator materializes that from the
frame).

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1177033006

Cr-Commit-Position: refs/heads/master@{#29025}

Port cdc43bc5

Original review: https://codereview.chromium.org/1133163005/

Original commit message:
Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
that arise.

BUG=

Review URL: https://codereview.chromium.org/1182193004

Cr-Commit-Position: refs/heads/master@{#29024}

R=jkummerow@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1191433003

Cr-Commit-Position: refs/heads/master@{#29023}

Revert of Fix clobbered register when setting this_function variable. (patchset #2 id:20001 of https://codereview.chromium.org/1185703002/)

Reason for revert:
[Sheriff] Makes mjsunit/es6/block-const-assign flaky, e.g.:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/4082

Original issue's description:
> Fix clobbered register when setting this_function variable.
>
> R=arv@chromium.org
> TEST=mjsunit/regress/regress-crbug-498022
> BUG=chromium:498022
> LOG=N
>
> Committed: https://crrev.com/bf2bbc8ba508ccd21edf3c08d2e4192c4764ae91
> Cr-Commit-Position: refs/heads/master@{#29020}

TBR=arv@chromium.org,rossberg@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:498022

Review URL: https://codereview.chromium.org/1184093003

Cr-Commit-Position: refs/heads/master@{#29022}

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1183133002

Cr-Commit-Position: refs/heads/master@{#29021}

R=arv@chromium.org
TEST=mjsunit/regress/regress-crbug-498022
BUG=chromium:498022
LOG=N

Review URL: https://codereview.chromium.org/1185703002

Cr-Commit-Position: refs/heads/master@{#29020}

Also fixed the duplicated output of context deopt.

BUG=

Review URL: https://codereview.chromium.org/1187533002

Cr-Commit-Position: refs/heads/master@{#29019}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1183123002

Cr-Commit-Position: refs/heads/master@{#29018}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1186713003

Cr-Commit-Position: refs/heads/master@{#29017}

R=jochen@chromium.org
BUG=v8:4179
LOG=N

Review URL: https://codereview.chromium.org/1183483006

Cr-Commit-Position: refs/heads/master@{#29016}

Doc: https://goo.gl/LLGvBs

BUG=

Review URL: https://codereview.chromium.org/1163143009

Cr-Commit-Position: refs/heads/master@{#29015}

Original review https://codereview.chromium.org/1133773002/

BUG=v8:3996
TBR=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1177293003

Cr-Commit-Position: refs/heads/master@{#29014}

Rolling v8/third_party/android_tools to ed3dde6470c39b196c70f0c20374894d169754ec

Resubmission of https://codereview.chromium.org/1183753006/

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/1181413003

Cr-Commit-Position: refs/heads/master@{#29013}

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1180113002

Cr-Commit-Position: refs/heads/master@{#29012}

This fixes a few funky implicit conversions for the enum (that are
inconsistent across compilers) and also helps to save space, i.e. for
the representations_ vector in the InstructionSequence.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1182303003

Cr-Commit-Position: refs/heads/master@{#29011}

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1179913003

Cr-Commit-Position: refs/heads/master@{#29010}