[turbofan] Relax restrictions on JSCreate inlining.

[turbofan] Relax restrictions on JSCreate inlining.

No need to limit JSCreate inlining to JS_OBJECT_TYPE, since we can
handle everything that the FastNewObjectStub can deal with. Also we
don't need to restrict the number of inobject properties, as that is
already taken care of by the runtime anyways (limited by the initial
slack for the constructor).

And last but not least, we can of course inline allocations for
subclasses as long as the new.target is a JSFunction and it's initial
map's constructor points back to the target (same condition as for
the FastNewObjectStub fast case).

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Committed: https://crrev.com/24c8f0b056ad306951759c33cefb5224c17e8b05
Cr-Commit-Position: refs/heads/master@{#34138}

[Jarin, 2016-02-19 07:39:22]

lgtm

[Benedikt Meurer, 2016-02-19 07:39:42]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2016-02-19 07:39:55]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1711883003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1711883003/1

[commit-bot: I haz the power, 2016-02-19 07:41:21]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-02-19 07:41:36]

Description was changed from

==========
[turbofan] Relax restrictions on JSCreate inlining.

No need to limit JSCreate inlining to JS_OBJECT_TYPE, since we can
handle everything that the FastNewObjectStub can deal with. Also we
don't need to restrict the number of inobject properties, as that is
already taken care of by the runtime anyways (limited by the initial
slack for the constructor).

And last but not least, we can of course inline allocations for
subclasses as long as the new.target is a JSFunction and it's initial
map's constructor points back to the target (same condition as for
the FastNewObjectStub fast case).

R=jarin@chromium.org
BUG=v8:4493
LOG=n
==========

to

==========
[turbofan] Relax restrictions on JSCreate inlining.

No need to limit JSCreate inlining to JS_OBJECT_TYPE, since we can
handle everything that the FastNewObjectStub can deal with. Also we
don't need to restrict the number of inobject properties, as that is
already taken care of by the runtime anyways (limited by the initial
slack for the constructor).

And last but not least, we can of course inline allocations for
subclasses as long as the new.target is a JSFunction and it's initial
map's constructor points back to the target (same condition as for
the FastNewObjectStub fast case).

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Committed: https://crrev.com/24c8f0b056ad306951759c33cefb5224c17e8b05
Cr-Commit-Position: refs/heads/master@{#34138}
==========

[commit-bot: I haz the power, 2016-02-19 07:41:37]

Patchset 1 (id:??) landed as
https://crrev.com/24c8f0b056ad306951759c33cefb5224c17e8b05
Cr-Commit-Position: refs/heads/master@{#34138}