Port 15c31fe4

Original Commit Message:

    This introduces Word64 support for the CheckBounds operator, which now
    lowers to either CheckedUint32Bounds or CheckedUint64Bounds after the
    representation selection. The right hand side of CheckBounds can now
    be any positive safe integer on 64-bit architectures, whereas it remains
    Unsigned31 for 32-bit architectures. We only use the extended Word64
    support when the right hand side is outside the Unsigned31 range, so
    for everything except DataViews this means that the performance should
    remain the same. The typing rule for the CheckBounds operator was
    updated to reflect this new behavior.

    The CheckBounds with a right hand side outside the Unsigned31 range will
    pass a new Signed64 feedback kind, which is handled with newly introduced
    CheckedFloat64ToInt64 and CheckedTaggedToInt64 operators in representation
    selection.

    The JSCallReducer lowering for DataView getType()/setType() methods was
    updated to not smi-check the [[ByteLength]] and [[ByteOffset]] anymore,
    but instead just use the raw uintptr_t values and operate on any value
    (for 64-bit architectures these fields can hold any positive safe
    integer, for 32-bit architectures it's limited to Unsigned31 range as
    before). This means that V8 can now handle huge DataViews fully, without
    falling off a performance cliff.

    This refactoring even gave us some performance improvements, on a simple
    micro-benchmark just exercising different DataView accesses we go from

      testDataViewGetUint8: 796 ms.
      testDataViewGetUint16: 997 ms.
      testDataViewGetInt32: 994 ms.
      testDataViewGetFloat64: 997 ms.

    to

      testDataViewGetUint8: 895 ms.
      testDataViewGetUint16: 889 ms.
      testDataViewGetInt32: 888 ms.
      testDataViewGetFloat64: 890 ms.

    meaning we lost around 10% on the single byte case, but gained 10% across
    the board for all the other element sizes.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ia86089ca9ccc75405aa13600b031c72bac0279dd
Reviewed-on: https://chromium-review.googlesource.com/c/1305035Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#57152}