Essentially a revert of https://codereview.chromium.org/1346013005 but
preserving the refactorings in elements.cc which happened in the mean time.

drive-by-fix: pass isolate as argument to more functions in elements.cc.

BUG=v8:4606
LOG=y

Review URL: https://codereview.chromium.org/1543563002

Cr-Commit-Position: refs/heads/master@{#33023}

Reland of [es6] ship regexp sticky flag. (patchset #1 id:1 of https://codereview.chromium.org/1531043002/ )

Reason for revert:
This can be relanded since the web compatibility fix in https://codereview.chromium.org/1543723002 has been submitted.

Original issue's description:
> Revert of [es6] ship regexp sticky flag. (patchset #2 id:20001 of https://codereview.chromium.org/1509733010/ )
>
> Reason for revert:
> This causes compatibility issues, as documented in https://bugs.chromium.org/p/v8/issues/detail?id=4617#c9
>
> Original issue's description:
> > [es6] ship regexp sticky flag.
> >
> > R=littledan@chromium.org
> > BUG=v8:4342
> > LOG=Y
> >
> > Committed: https://crrev.com/86c2dd4042dc9ce293e004234eb094f2b51d9640
> > Cr-Commit-Position: refs/heads/master@{#32826}
>
> TBR=yangguo@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4342

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4342

Review URL: https://codereview.chromium.org/1546563002

Cr-Commit-Position: refs/heads/master@{#33003}

The Inbox problem got resolved so staging is ok.

BUG=v8:3305
LOG=Y
R=adamk@chromium.org, littledan@chromium.org,rossberg@chromium.org

Review URL: https://codereview.chromium.org/1538243002

Cr-Commit-Position: refs/heads/master@{#32992}

R=hablich@chromium.org
BUG=v8:4545
LOG=N

Review URL: https://codereview.chromium.org/1537273004

Cr-Commit-Position: refs/heads/master@{#32987}

BUG=v8:1543,v8:3931
LOG=y

Review URL: https://codereview.chromium.org/1528423002

Cr-Commit-Position: refs/heads/master@{#32967}

Reason for revert:
Revive left-trimming until new strategies are evaluated and decided on.

Partially reverted changes from:
https://codereview.chromium.org/1474203003/

BUG=v8:4606
LOG=N

Original issue's description:
> [heap] delete Heap::LeftTrimFixedAray
>
> No more uses left for this code (thank goodness.)
>
> R=hpayer@chromium.org
> BUG=
>
> Committed: https://crrev.com/dc3442b1ec803916eb6c1882ab4c3ec6fd44dd55
> Cr-Commit-Position: refs/heads/master@{#32305}

TBR=hpayer@chromium.org,ofrobots@google.com

Review URL: https://codereview.chromium.org/1535933002

Cr-Commit-Position: refs/heads/master@{#32965}

Add an internal field to each wasm function to keep a reference to the module. (So the GC can do the right thing when you only hold references to wasm functions but not the module).

Use Realloc carefully, to avoid copying from out of bounds.

Make snprintf use platform independent.

Don't disconnect external arraybuffers provided for the heap.

R=ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1531243003

Cr-Commit-Position: refs/heads/master@{#32951}

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1533813002

Cr-Commit-Position: refs/heads/master@{#32941}

Reason for revert:
This causes compatibility issues, as documented in https://bugs.chromium.org/p/v8/issues/detail?id=4617#c9

Original issue's description:
> [es6] ship regexp sticky flag.
>
> R=littledan@chromium.org
> BUG=v8:4342
> LOG=Y
>
> Committed: https://crrev.com/86c2dd4042dc9ce293e004234eb094f2b51d9640
> Cr-Commit-Position: refs/heads/master@{#32826}

TBR=yangguo@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4342
LOG=Y

Review URL: https://codereview.chromium.org/1531243002

Cr-Commit-Position: refs/heads/master@{#32932}

BUG=v8:811
LOG=y

Review URL: https://codereview.chromium.org/1515613009

Cr-Commit-Position: refs/heads/master@{#32905}

R=hablich@chromium.org
BUG=v8:4545
LOG=Y

Review URL: https://codereview.chromium.org/1524233003

Cr-Commit-Position: refs/heads/master@{#32889}

Original CL: https://codereview.chromium.org/1375253002/

Implement machine instruction scheduling after instruction selection.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1526913003

Cr-Commit-Position: refs/heads/master@{#32869}

Revert of [WIP][turbofan] Instruction scheduler for Turbofan. (patchset #7 id:120001 of https://codereview.chromium.org/1375253002/ )

Reason for revert:
Does not compile

https://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20debug%20builder/builds/6870/steps/compile/logs/stdio

Original issue's description:
> [turbofan] Instruction scheduler for Turbofan.
>
> Implement machine instruction scheduling after instruction selection.
>
> Currently only works for arm64.
>
> R=danno@chromium.org, bmeurer@chromium.org, titzer@chromium.org
>
> Committed: https://crrev.com/e11bba3acd5188f0e12686b6fcf3e0ab22989216
> Cr-Commit-Position: refs/heads/master@{#32858}

TBR=jarin@chromium.org,bmeurer@chromium.org,baptiste.afsa@arm.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1526913002

Cr-Commit-Position: refs/heads/master@{#32860}

Implement machine instruction scheduling after instruction selection.

Currently only works for arm64.

R=danno@chromium.org, bmeurer@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/1375253002

Cr-Commit-Position: refs/heads/master@{#32858}

Debug evaluate no longer writes back changes to the replicated
context chain to the original after execution. Changes to the
global object or script contexts still stick. Calling functions
that bind to the original context chain also have their expected
side effects.

As far as I can tell, DevTools is not interested in modifying
local variable values. Modifying global variable values still
works as expected. However, I have not yet removed the old
implementation, but merely keep it behind a flag.

R=mstarzinger@chromium.org, rossberg@chromium.org

Committed: https://crrev.com/92caa9b85eefffbef51c67428397951bd2e2c330
Cr-Commit-Position: refs/heads/master@{#32841}

Review URL: https://codereview.chromium.org/1513183003

Cr-Commit-Position: refs/heads/master@{#32857}

Turning it off broke both the trace viewer and using the devtools
to connect to an earlier version of Chrome running on another device.

BUG=chromium:552100, chromium:569417, chromium:569647
TBR=rossberg@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1521993004 .

Cr-Commit-Position: refs/heads/master@{#32850}

Revert of [debugger] debug-evaluate should not not modify local values. (patchset #2 id:20001 of https://codereview.chromium.org/1513183003/ )

Reason for revert:
[Sheriff] Layout test changes.

Original issue's description:
> [debugger] debug-evaluate should not not modify local values.
>
> Debug evaluate no longer writes back changes to the replicated
> context chain to the original after execution. Changes to the
> global object or script contexts still stick. Calling functions
> that bind to the original context chain also have their expected
> side effects.
>
> As far as I can tell, DevTools is not interested in modifying
> local variable values. Modifying global variable values still
> works as expected. However, I have not yet removed the old
> implementation, but merely keep it behind a flag.
>
> R=mstarzinger@chromium.org, rossberg@chromium.org
>
> Committed: https://crrev.com/92caa9b85eefffbef51c67428397951bd2e2c330
> Cr-Commit-Position: refs/heads/master@{#32841}

TBR=mstarzinger@chromium.org,rossberg@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1526553003

Cr-Commit-Position: refs/heads/master@{#32845}

Debug evaluate no longer writes back changes to the replicated
context chain to the original after execution. Changes to the
global object or script contexts still stick. Calling functions
that bind to the original context chain also have their expected
side effects.

As far as I can tell, DevTools is not interested in modifying
local variable values. Modifying global variable values still
works as expected. However, I have not yet removed the old
implementation, but merely keep it behind a flag.

R=mstarzinger@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1513183003

Cr-Commit-Position: refs/heads/master@{#32841}

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1514123002

Cr-Commit-Position: refs/heads/master@{#32834}

R=littledan@chromium.org, rossberg@chromium.org
BUG=v8:4545
LOG=Y

Review URL: https://codereview.chromium.org/1512253003

Cr-Commit-Position: refs/heads/master@{#32830}

R=littledan@chromium.org
BUG=v8:4342
LOG=Y

Review URL: https://codereview.chromium.org/1509733010

Cr-Commit-Position: refs/heads/master@{#32826}

Array.prototype.includes shipped in Chrome 47.

Review URL: https://codereview.chromium.org/1513843006

Cr-Commit-Position: refs/heads/master@{#32818}

This is behind the --harmony-function-name flag, currently disabled.

With the flag enabled, we now pass the relevant tests in
language/statements/*/fn-name-*.

BUG=v8:3699
LOG=y

Review URL: https://codereview.chromium.org/1518873004

Cr-Commit-Position: refs/heads/master@{#32817}

It shipped in Chrome 47.

Review URL: https://codereview.chromium.org/1519073004

Cr-Commit-Position: refs/heads/master@{#32816}

BUG=chromium:552100
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1515473004

Cr-Commit-Position: refs/heads/master@{#32815}

This patch removes Promise functions and methods which are absent
from the ES2015 specification when the --es-staging flag is on.
The patch is being relanded after being reverted due to an
unrelated bug. This version is slightly different as promise_chain
is installed on the context regardless of the flag value, so that
the Promise::Chain API continues to work until it is deprecated.

BUG=v8:3237
R=rossberg
LOG=Y

Review URL: https://codereview.chromium.org/1513873002

Cr-Commit-Position: refs/heads/master@{#32772}

BUG=v8:811
LOG=n

Review URL: https://codereview.chromium.org/1512153002

Cr-Commit-Position: refs/heads/master@{#32751}

This adds a runtime flag that controls whether the WASM object is
exposed to JavaScript. While currently guarded by the V8_WASM build-time
flag, after landing in V8 the build-time flag will be removed, leaving
only this new runtime flag.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1507623002

Cr-Commit-Position: refs/heads/master@{#32657}

Attempt #<really big number>

Parses, and lazily rewrites Destructuring Assignment expressions. The rewriting strategy involves inserting a placeholder RewritableAssignmentExpression into the AST, whose content expression can be completely rewritten at a later time.

Lazy rewriting ensures that errors do not occur due to eagerly rewriting nodes which form part of a binding pattern, thus breaking the meaning of the pattern --- or by eagerly rewriting ambiguous constructs that are not immediately known

BUG=v8:811
LOG=Y
R=adamk@chromium.org, bmeurer@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1309813007

Cr-Commit-Position: refs/heads/master@{#32623}

BUG=chromium:565306
LOG=NO

Review URL: https://codereview.chromium.org/1497743003

Cr-Commit-Position: refs/heads/master@{#32603}

BUG=

Review URL: https://codereview.chromium.org/1496253002

Cr-Commit-Position: refs/heads/master@{#32602}

Revert of Disable non-standard Promise functions in staging (patchset #1 id:1 of https://codereview.chromium.org/1478533002/ )

Reason for revert:
Will test better; there seems to be a bug related to this.

Original issue's description:
> Reland of Disable non-standard Promise functions in staging (patchset #1 id:1 of https://codereview.chromium.org/1473603002/ )
>
> Reason for revert:
> Breakage in Ignition seems unrelated; relanding.
>
> Original issue's description:
> > Revert of Disable non-standard Promise functions in staging (patchset #5 id:80001 of https://codereview.chromium.org/1469543003/ )
> >
> > Reason for revert:
> > [Sheriff] This breaks ignition on arm sim debug:
> > https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm%20-%20sim%20-%20debug/builds/5317
> >
> > Seems to not be caught by the cq bot that builds release with dchecks.
> >
> > Original issue's description:
> > > Disable non-standard Promise functions in staging
> > >
> > > This patch removes Promise functions and methods which are absent
> > > from the ES2015 specification when the --es-staging flag is on.
> > >
> > > BUG=v8:3237
> > > R=rossberg
> > > LOG=Y
> > >
> > > Committed: https://crrev.com/941251af7e04d50ac2243da2870249a42111221a
> > > Cr-Commit-Position: refs/heads/master@{#32194}
> >
> > TBR=rossberg@chromium.org,littledan@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=v8:3237
> >
> > Committed: https://crrev.com/86bd2b3c23b562213d5af158849dcd65f347a827
> > Cr-Commit-Position: refs/heads/master@{#32199}
>
> TBR=rossberg@chromium.org,rmcilroy@chromium.org,machenbach@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3237
>
> Committed: https://crrev.com/9278b7b05a45c2089007e8b61822af96b5d0c8df
> Cr-Commit-Position: refs/heads/master@{#32235}

TBR=rossberg@chromium.org,rmcilroy@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3237

Review URL: https://codereview.chromium.org/1493713004

Cr-Commit-Position: refs/heads/master@{#32530}

This is the first part of escape analysis for turbofan.
At the moment, there is no deopt support, and support
for loops is partial (only binary Phis are handled).

The CL includes 4 unittests.

There are also 8 new mjsunit tests, some of which are
skiped as they require features not yet implemented.

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1457683003

Cr-Commit-Position: refs/heads/master@{#32498}

Also fix CheckConflictingVarDeclarations() to properly handle
legacy const bindings. Without that change enabling the flag
causes code like:

  function f() { const x; var x; }

to throw an early error, rather than wait to throw the error
until f is invoked.

The previous patch ran into problems with the fuzzer; that crash was fixed
(with test coverage added) in https://crrev.com/ceb92ebfdfb561d71038793c02b42aa973f55ec4

BUG=v8:811
LOG=y
TBR=rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1473243006

Cr-Commit-Position: refs/heads/master@{#32306}

No more uses left for this code (thank goodness.)

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1474693003

Cr-Commit-Position: refs/heads/master@{#32305}

Reland of Disable non-standard Promise functions in staging (patchset #1 id:1 of https://codereview.chromium.org/1473603002/ )

Reason for revert:
Breakage in Ignition seems unrelated; relanding.

Original issue's description:
> Revert of Disable non-standard Promise functions in staging (patchset #5 id:80001 of https://codereview.chromium.org/1469543003/ )
>
> Reason for revert:
> [Sheriff] This breaks ignition on arm sim debug:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm%20-%20sim%20-%20debug/builds/5317
>
> Seems to not be caught by the cq bot that builds release with dchecks.
>
> Original issue's description:
> > Disable non-standard Promise functions in staging
> >
> > This patch removes Promise functions and methods which are absent
> > from the ES2015 specification when the --es-staging flag is on.
> >
> > BUG=v8:3237
> > R=rossberg
> > LOG=Y
> >
> > Committed: https://crrev.com/941251af7e04d50ac2243da2870249a42111221a
> > Cr-Commit-Position: refs/heads/master@{#32194}
>
> TBR=rossberg@chromium.org,littledan@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3237
>
> Committed: https://crrev.com/86bd2b3c23b562213d5af158849dcd65f347a827
> Cr-Commit-Position: refs/heads/master@{#32199}

TBR=rossberg@chromium.org,rmcilroy@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3237

Review URL: https://codereview.chromium.org/1478533002

Cr-Commit-Position: refs/heads/master@{#32235}

Some highlights of this CL:
* Refactor the mutable state out of Frame into FrameAccessState,
  which is maintained and updated during code generation to
  record whether sp- or fp-based frame access is currently active
  and how deep the stack on top of the frame is.
* The operand resultion in linkage.cc now uses FrameAccessState
  to determine how to generate frame-accessing operands.
* Update all platforms to accurately track additionally pushed
  stack slots (e.g. arguments for calls) in the FrameAccessState.
* Add a flag, --turbo_sp_frame_access, which forces all frame
  access to be sp-based whenever possible. This will likely never
  be used in production, but for testing it's useful in verifying
  that the stack-tracking of each platform maintained in the
  FrameAccessState is correct.
* Use sp-based frame access for gap resolving before tail
  calls. This will allow for slightly more efficient restoration
  of the frame pointer in the tail call in a later CL.
* Remove most ad hoc groping into CallDescriptors to
  determine if a frame is needed, instead consistently use
  predicates like needs_frame(), IsCFunctionCall() and
  IsJSFunctionCall().

BUG=v8:4076
LOG=n

Review URL: https://codereview.chromium.org/1460183002

Cr-Commit-Position: refs/heads/master@{#32234}

Revert of Move --harmony-destructuring-bind to shipping (patchset #5 id:80001 of https://codereview.chromium.org/1451843002/ )

Reason for revert:
Fails on V8 Fuzzer: https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/6028

Original issue's description:
> Move --harmony-destructuring-bind to shipping
>
> Also fix CheckConflictingVarDeclarations() to properly handle
> legacy const bindings. Without that change enabling the flag
> causes code like:
>
>   function f() { const x; var x; }
>
> to throw an early error, rather than wait to throw the error
> until f is invoked.
>
> BUG=v8:811
> LOG=y
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/515093630a4a925a66d550561e38293d49633f10
> Cr-Commit-Position: refs/heads/master@{#32222}

TBR=rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1470333002

Cr-Commit-Position: refs/heads/master@{#32226}

Also fix CheckConflictingVarDeclarations() to properly handle
legacy const bindings. Without that change enabling the flag
causes code like:

  function f() { const x; var x; }

to throw an early error, rather than wait to throw the error
until f is invoked.

BUG=v8:811
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1451843002

Cr-Commit-Position: refs/heads/master@{#32222}

Revert of Disable non-standard Promise functions in staging (patchset #5 id:80001 of https://codereview.chromium.org/1469543003/ )

Reason for revert:
[Sheriff] This breaks ignition on arm sim debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm%20-%20sim%20-%20debug/builds/5317

Seems to not be caught by the cq bot that builds release with dchecks.

Original issue's description:
> Disable non-standard Promise functions in staging
>
> This patch removes Promise functions and methods which are absent
> from the ES2015 specification when the --es-staging flag is on.
>
> BUG=v8:3237
> R=rossberg
> LOG=Y
>
> Committed: https://crrev.com/941251af7e04d50ac2243da2870249a42111221a
> Cr-Commit-Position: refs/heads/master@{#32194}

TBR=rossberg@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3237

Review URL: https://codereview.chromium.org/1473603002

Cr-Commit-Position: refs/heads/master@{#32199}