Port be4cd67c

Original Commit Message:

    This adds support for poisoning the stack pointer and implicit register
    arguments like the context register and the function register in the
    prologue of generated code with JavaScript linkage. The speculation
    poison is computed similarly to the interpreter by matching expected
    with actual code start addresses.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:798964
LOG=N

Change-Id: I0d015fd8a8f05982d947a4a1c0be1a825ac19d64
Reviewed-on: https://chromium-review.googlesource.com/940460Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#51621}