This patch introduces a mechanism for changing the scope of temporary
variables, which is necessary for rewriting arrow parameter
initializers.

It also fixes a potential bug in AstExpressionVisitor, which did not
visit the automatically generated members of ForEachStatement.

Fixes test/mjsunit/harmony/regress/regress-4658.js

R=rossberg@chromium.org
BUG=v8:4658
LOG=N

Review URL: https://codereview.chromium.org/1564343002

Cr-Commit-Position: refs/heads/master@{#33183}

Matches https://crrev.com/366832

BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1551453002

Cr-Commit-Position: refs/heads/master@{#33182}

Adds support for calling runtime functions which return a pair of
values. Adds the bytecode CallRuntimePair. Also adds support to TurboFan
for calling stubs which return multiple values.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1568493002

Cr-Commit-Position: refs/heads/master@{#33181}

R=cbruni@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1543553002

Cr-Commit-Position: refs/heads/master@{#33180}

BUG=chromium:574953
LOG=n

Review URL: https://codereview.chromium.org/1570443004

Cr-Commit-Position: refs/heads/master@{#33179}

It's sufficient to check for --harmony-unicode-regexps when parsing the
regexp flags from string.

R=neis@chromium.org

Review URL: https://codereview.chromium.org/1567413002

Cr-Commit-Position: refs/heads/master@{#33178}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1567393003

Cr-Commit-Position: refs/heads/master@{#33177}

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1568293002

Cr-Commit-Position: refs/heads/master@{#33176}

R=mstarzinger@chromium.org,bradnelson@chromium.org
LOG=Y
BUG=chromium:575364

Review URL: https://codereview.chromium.org/1564313003

Cr-Commit-Position: refs/heads/master@{#33175}

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1569223002

Cr-Commit-Position: refs/heads/master@{#33174}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1571713002

Cr-Commit-Position: refs/heads/master@{#33173}

There's no reason to have JavaScript wrappers for those accessors,
since the meat is already in hand-written native code (via %_DateField).
First step now to put them into native builtins. Next step will be to
completely remove %_DateField.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1567353002

Cr-Commit-Position: refs/heads/master@{#33172}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1571703002

Cr-Commit-Position: refs/heads/master@{#33171}

* Buffer counter updates in the corresponding visitor to allow parallel
  processing of pages.
* Fix a bug where we don't keep live bytes in sync when marking is already
  finished.

LOG=N
BUG=524425

Review URL: https://codereview.chromium.org/1559873004

Cr-Commit-Position: refs/heads/master@{#33170}

R=rossberg@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/1565183002

Cr-Commit-Position: refs/heads/master@{#33169}

LOG=N
BUG=v8:4606
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1572513002

Cr-Commit-Position: refs/heads/master@{#33168}

Everything necessary to implement Object.keys efficiently is already
available in C++ land for quite some time now, and only the thin
JavaScript wrapper was left, so get rid of that as well and move the
whole builtin to C++ instead.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1567963002

Cr-Commit-Position: refs/heads/master@{#33167}

  The original kX87BitcastFI and kX87BitcastIF of x87 code generation in TurboFan have bugs and caused all Run_Wasm_F32CopySign test cases failed.

  This CL will fix them.

BUG=

Review URL: https://codereview.chromium.org/1565183003

Cr-Commit-Position: refs/heads/master@{#33166}

Requesting reservation of a wasm section for experimentation with
storing source code meta information, such as source code comments,
and also extra inform on presentation of the AST such an `if-block`
pattern being presented as a `when` operation.

The wasm design already defines unrecognized sections to be ignored,
and this reserved section is ignored. This section is only intended to
hold source code meta information and to have no effect on code
execution.

With wasm going live (behind a flag) on v8, I would also like to be
able to give people something to play with in terms of the deployed
binary code being a useful source code. It's all experimental, but I
understand the entire binary format that V8 is currently using is
basically a throwaway, and that the working strategy is to get
something running and then revisit format decisions.

I would like a fixed reserved section number to avoid potential
clashes with other projects - although I am not aware of any other
calls for addition sections beyond the need for debug info. If a fixed
number is not acceptable, then could this patch alternatively ignore
all unrecognized sections and perhaps add the section size to them
all - something which is already noted todo in the design document?

BUG=

Review URL: https://codereview.chromium.org/1565693002

Cr-Commit-Position: refs/heads/master@{#33165}

Fixes a number of test262 tests, including:

- built-ins/Promise/reject-function-nonconstructor.js
- built-ins/Promise/resolve-function-nonconstructor.js
- built-ins/Promise/all/resolve-element-function-nonconstructor.js
- built-ins/Promise/executor-function-nonconstructor.js

BUG=v8:4633
LOG=N
R=adamk@chromium.org, cbruni@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1565303004

Cr-Commit-Position: refs/heads/master@{#33164}

Testing the promise status is not enough to ensure that resolve functions are
called only once.

This change adds a similar version of the [[AlreadyResolved]] slot to the
Promise.all resolve element function, and also ensures that [[AlreadyResolved]]
is respected in the Promise executor, and when resolving thenables. This means
replacing PromiseReject() shortcuts with promiseCapability.reject(), which has
an [[AlreadyResolved]] record in a context slot.

Also ensures that changes to the list accumulator in Promise.all() is not observable
via accessors installed in the Array prototype chain, using the same mechanism used
in several Array methods.

Fixes the following Test262 tests:
- built-ins/Promise/all/call-resolve-element-items.js
- built-ins/Promise/all/call-resolve-element.js
- built-ins/Promise/all/call-resolve-element-after-return.js
- built-ins/Promise/all/same-reject-function.js
- built-ins/Promise/all/resolve-from-same-thenable.js
- built-ins/Promise/all/resolve-before-loop-exit.js
- built-ins/Promise/all/resolve-before-loop-exit-from-same.js
- built-ins/Promise/exception-after-resolve-in-executor.js
- built-ins/Promise/exception-after-resolve-in-thenable-job.js
- built-ins/Promise/all/does-not-invoke-array-setters.js

BUG=v8:4633
LOG=N
R=littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1534813005

Cr-Commit-Position: refs/heads/master@{#33163}

Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #7 id:120001 of https://codereview.chromium.org/1551443002/ )

Reason for revert:
Causes frequent crashes in Canary: chromium:537816

Original issue's description:
> Ship ES2015 sloppy-mode function hoisting, let, class
>
> This patch doesn't ship all features of ES2015 variable/scoping
> changes, notably omitting the removal of legacy const. I think
> function hoisting, let and class in sloppy mode can stand to
> themselves as a package, and the legacy const change is much
> riskier and more likely to be reverted, so my intention is to
> pursue those as a separate, follow-on patch.
>
> R=adamk@chromium.org
> BUG=v8:4285,v8:3305
> LOG=Y
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> Cr-Commit-Position: refs/heads/master@{#33133}

TBR=adamk@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4285,v8:3305,chromium:537816
LOG=Y

Review URL: https://codereview.chromium.org/1565263002

Cr-Commit-Position: refs/heads/master@{#33162}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1564053002

Cr-Commit-Position: refs/heads/master@{#33161}

BUG=v8:4633
LOG=N
R=adamk@chromium.org, littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1568433004

Cr-Commit-Position: refs/heads/master@{#33160}

Some tests passed a string as second argument to assertThrows, expecting it to
be matched against the exception.  However, assertThrows simply ignored these.
(Some other tests actually seem to use that argument as a comment ...)

This CL
- changes assertThrows to fail if the second argument is not a function,
- adds assertThrowsEquals which compares the exception to a given value using
  assertEquals
- fixes some bogus tests that got exposed by this.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1544793002

Cr-Commit-Position: refs/heads/master@{#33159}

Empty FixedDoubleArrays aren't FixedDoubleArrays.

BUG=chromium:569534
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1568863002

Cr-Commit-Position: refs/heads/master@{#33158}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1567853002

Cr-Commit-Position: refs/heads/master@{#33157}

R=danno@chromium.org

Review URL: https://codereview.chromium.org/1555823002

Cr-Commit-Position: refs/heads/master@{#33156}

Previously only references to function contexts embedded in optimized
were treated weakly, but TurboFan (and to some extend Crankshaft) can
embed any kind of context into optimized code.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1562083003

Cr-Commit-Position: refs/heads/master@{#33155}

Cr-Commit-Position: refs/heads/master@{#33154}

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1567733004

Cr-Commit-Position: refs/heads/master@{#33153}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1562883003

Cr-Commit-Position: refs/heads/master@{#33152}

BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1563163003

Cr-Commit-Position: refs/heads/master@{#33151}

BUG=v8:4280
LOG=N
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1568533005

Cr-Commit-Position: refs/heads/master@{#33150}

R=yangguo@chromium.org
BUG=chromium:575082
LOG=n

Review URL: https://codereview.chromium.org/1566973002

Cr-Commit-Position: refs/heads/master@{#33149}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1567633002

Cr-Commit-Position: refs/heads/master@{#33148}

  port a94d6d6e (r33108)

  original commit message:
  The mode requires an extra register, and since we aren't supporting it now, we can dispense with it.

BUG=

Review URL: https://codereview.chromium.org/1561943002

Cr-Commit-Position: refs/heads/master@{#33147}

This correctly marks functions containing a new.target reference as
being disabled with Crankshaft, which would have bailed out anyways.
Also note that this will trigger TurboFan for such functions and hence
widens the TurboFan intake valve.

Review URL: https://codereview.chromium.org/1568763002

Cr-Commit-Position: refs/heads/master@{#33146}

Rolling v8/buildtools to 0f8e6e4b126ee88137930a0ae4776c4741808740

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1569583003

Cr-Commit-Position: refs/heads/master@{#33145}

This patch implements @@species, guarded behind the --harmony-species
flag, on Arrays. Methods which return an Array will instead return
the appropriate instance based on the ArraySpeciesCreate algorithm.
The algorithm is implemented in C++ to get access to realm information
and to implement some Array methods in C++, but it is also accessed
from JavaScript through a new runtime function. A couple interactive
Octane runs show no performance regression with the flag turned off,
but turning --harmony-species on will surely have a significant
regression, as Array methods now heavily use ObjectDefineProperty.

BUG=v8:4093
LOG=Y
R=adamk,cbruni

Review URL: https://codereview.chromium.org/1560763002

Cr-Commit-Position: refs/heads/master@{#33144}