[deoptimizer] Fix materialization of sloppy arguments.

[deoptimizer] Fix materialization of sloppy arguments.

This makes sure the deoptimizer can materialize sloppy arguments objects
with the FAST_SLOPPY_ARGUMENTS_ELEMENTS elements kind. TurboFan's escape
analysis treates those as normal JSObject types and hence materializes
them differently than Crankshaft does.

R=verwaest@chromium.org
TEST=mjsunit/regress/regress-crbug-613919
BUG=chromium:613919
Committed: https://crrev.com/3cc2adb3195afe8f6eb671664bd65828eb68adb1
Cr-Commit-Position: refs/heads/master@{#36440}

[Michael Starzinger, 2016-05-23 13:08:13]

I ended up handling the sloppy arguments case in the deoptimizer itself. It
turns out that the assumption that sloppy elements kind implies {length >= 2} is
more ingrained in the code-base than I initially thought. The heap verifier also
checks is. So I ended up reproducing the same allocation pattern that we already
use in the factory.

[Toon Verwaest, 2016-05-23 13:48:00]

lgtm

[Michael Starzinger, 2016-05-23 13:48:53]

The CQ bit was checked by mstarzinger@chromium.org

[commit-bot: I haz the power, 2016-05-23 13:48:58]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2001133002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2001133002/1

[commit-bot: I haz the power, 2016-05-23 13:50:58]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-05-23 13:52:45]

Description was changed from

==========
[deoptimizer] Fix materialization of sloppy arguments.

This makes sure the deoptimizer can materialize sloppy arguments objects
with the FAST_SLOPPY_ARGUMENTS_ELEMENTS elements kind. TurboFan's escape
analysis treates those as normal JSObject types and hence materializes
them differently than Crankshaft does.

R=verwaest@chromium.org
TEST=mjsunit/regress/regress-crbug-613919
BUG=chromium:613919
==========

to

==========
[deoptimizer] Fix materialization of sloppy arguments.

This makes sure the deoptimizer can materialize sloppy arguments objects
with the FAST_SLOPPY_ARGUMENTS_ELEMENTS elements kind. TurboFan's escape
analysis treates those as normal JSObject types and hence materializes
them differently than Crankshaft does.

R=verwaest@chromium.org
TEST=mjsunit/regress/regress-crbug-613919
BUG=chromium:613919

Committed: https://crrev.com/3cc2adb3195afe8f6eb671664bd65828eb68adb1
Cr-Commit-Position: refs/heads/master@{#36440}
==========

[commit-bot: I haz the power, 2016-05-23 13:52:46]

Patchset 1 (id:??) landed as
https://crrev.com/3cc2adb3195afe8f6eb671664bd65828eb68adb1
Cr-Commit-Position: refs/heads/master@{#36440}