Testing the promise status is not enough to ensure that resolve functions are
called only once.

This change adds a similar version of the [[AlreadyResolved]] slot to the
Promise.all resolve element function, and also ensures that [[AlreadyResolved]]
is respected in the Promise executor, and when resolving thenables. This means
replacing PromiseReject() shortcuts with promiseCapability.reject(), which has
an [[AlreadyResolved]] record in a context slot.

Also ensures that changes to the list accumulator in Promise.all() is not observable
via accessors installed in the Array prototype chain, using the same mechanism used
in several Array methods.

Fixes the following Test262 tests:
- built-ins/Promise/all/call-resolve-element-items.js
- built-ins/Promise/all/call-resolve-element.js
- built-ins/Promise/all/call-resolve-element-after-return.js
- built-ins/Promise/all/same-reject-function.js
- built-ins/Promise/all/resolve-from-same-thenable.js
- built-ins/Promise/all/resolve-before-loop-exit.js
- built-ins/Promise/all/resolve-before-loop-exit-from-same.js
- built-ins/Promise/exception-after-resolve-in-executor.js
- built-ins/Promise/exception-after-resolve-in-thenable-job.js
- built-ins/Promise/all/does-not-invoke-array-setters.js

BUG=v8:4633
LOG=N
R=littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1534813005

Cr-Commit-Position: refs/heads/master@{#33163}

Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset #7 id:120001 of https://codereview.chromium.org/1551443002/ )

Reason for revert:
Causes frequent crashes in Canary: chromium:537816

Original issue's description:
> Ship ES2015 sloppy-mode function hoisting, let, class
>
> This patch doesn't ship all features of ES2015 variable/scoping
> changes, notably omitting the removal of legacy const. I think
> function hoisting, let and class in sloppy mode can stand to
> themselves as a package, and the legacy const change is much
> riskier and more likely to be reverted, so my intention is to
> pursue those as a separate, follow-on patch.
>
> R=adamk@chromium.org
> BUG=v8:4285,v8:3305
> LOG=Y
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> Cr-Commit-Position: refs/heads/master@{#33133}

TBR=adamk@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4285,v8:3305,chromium:537816
LOG=Y

Review URL: https://codereview.chromium.org/1565263002

Cr-Commit-Position: refs/heads/master@{#33162}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1564053002

Cr-Commit-Position: refs/heads/master@{#33161}

BUG=v8:4633
LOG=N
R=adamk@chromium.org, littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1568433004

Cr-Commit-Position: refs/heads/master@{#33160}

Some tests passed a string as second argument to assertThrows, expecting it to
be matched against the exception.  However, assertThrows simply ignored these.
(Some other tests actually seem to use that argument as a comment ...)

This CL
- changes assertThrows to fail if the second argument is not a function,
- adds assertThrowsEquals which compares the exception to a given value using
  assertEquals
- fixes some bogus tests that got exposed by this.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1544793002

Cr-Commit-Position: refs/heads/master@{#33159}

Empty FixedDoubleArrays aren't FixedDoubleArrays.

BUG=chromium:569534
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1568863002

Cr-Commit-Position: refs/heads/master@{#33158}

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1567853002

Cr-Commit-Position: refs/heads/master@{#33157}

R=danno@chromium.org

Review URL: https://codereview.chromium.org/1555823002

Cr-Commit-Position: refs/heads/master@{#33156}

Previously only references to function contexts embedded in optimized
were treated weakly, but TurboFan (and to some extend Crankshaft) can
embed any kind of context into optimized code.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1562083003

Cr-Commit-Position: refs/heads/master@{#33155}

Cr-Commit-Position: refs/heads/master@{#33154}

R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1567733004

Cr-Commit-Position: refs/heads/master@{#33153}

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1562883003

Cr-Commit-Position: refs/heads/master@{#33152}

BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1563163003

Cr-Commit-Position: refs/heads/master@{#33151}

BUG=v8:4280
LOG=N
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1568533005

Cr-Commit-Position: refs/heads/master@{#33150}

R=yangguo@chromium.org
BUG=chromium:575082
LOG=n

Review URL: https://codereview.chromium.org/1566973002

Cr-Commit-Position: refs/heads/master@{#33149}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1567633002

Cr-Commit-Position: refs/heads/master@{#33148}

  port a94d6d6e (r33108)

  original commit message:
  The mode requires an extra register, and since we aren't supporting it now, we can dispense with it.

BUG=

Review URL: https://codereview.chromium.org/1561943002

Cr-Commit-Position: refs/heads/master@{#33147}

This correctly marks functions containing a new.target reference as
being disabled with Crankshaft, which would have bailed out anyways.
Also note that this will trigger TurboFan for such functions and hence
widens the TurboFan intake valve.

Review URL: https://codereview.chromium.org/1568763002

Cr-Commit-Position: refs/heads/master@{#33146}

Rolling v8/buildtools to 0f8e6e4b126ee88137930a0ae4776c4741808740

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1569583003

Cr-Commit-Position: refs/heads/master@{#33145}

This patch implements @@species, guarded behind the --harmony-species
flag, on Arrays. Methods which return an Array will instead return
the appropriate instance based on the ArraySpeciesCreate algorithm.
The algorithm is implemented in C++ to get access to realm information
and to implement some Array methods in C++, but it is also accessed
from JavaScript through a new runtime function. A couple interactive
Octane runs show no performance regression with the flag turned off,
but turning --harmony-species on will surely have a significant
regression, as Array methods now heavily use ObjectDefineProperty.

BUG=v8:4093
LOG=Y
R=adamk,cbruni

Review URL: https://codereview.chromium.org/1560763002

Cr-Commit-Position: refs/heads/master@{#33144}

  The reason is same as the CL #31808 (issue 1430943002, X87: Change the test case for X87 float operations), please refer: https://codereview.chromium.org/1430943002/

  Here is the key comments from CL #31808
  Some new test cases use CheckFloatEq(...) and CheckDoubleEq(...) function for result check. When GCC compiling the CheckFloatEq() and CheckDoubleEq() function, those inlined functions has different behavior comparing with GCC ia32 build and x87 build.
  The major difference is sse float register still has single precision rounding semantic. While X87 register has no such rounding precsion semantic when directly use register value.
  The V8 turbofan JITTed has exactly same result in both X87 and IA32 port.

  So we add the following sentence to do type case to keep the same precision for Run_WasmCall_Float32Sub.
  Such as: volatile float expect = *i +/- *j; // *i +/- *j, etc.

BUG=

Review URL: https://codereview.chromium.org/1561023002

Cr-Commit-Position: refs/heads/master@{#33143}

- Each of the three deprecated Promise functions
- Two nonstandard pieces of Intl functionality
- Accesses of the RegExp.prototype.unicode getter on the prototype

BUG=v8:3785,v8:3238,v8:4633
LOG=N
R=adamk
TBR=hpayer

Review URL: https://codereview.chromium.org/1558113002

Cr-Commit-Position: refs/heads/master@{#33142}

This required refactoring ParsePropertyDefinition to pass the parsed
string name as an out param, since ObjectLiteralProperty stores Smis
for Smi-representable property keys.

Computed properties are not yet handled in this patch.

BUG=v8:3699
LOG=n

Review URL: https://codereview.chromium.org/1563923002

Cr-Commit-Position: refs/heads/master@{#33141}

R=bradnelson@chromium.org, titzer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1567753002

Cr-Commit-Position: refs/heads/master@{#33140}

R=bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1537743003

Cr-Commit-Position: refs/heads/master@{#33139}

Utilise Dextu, Dextm on mips64 for widths and positions larger
than 32.

TEST=
BUG=

Review URL: https://codereview.chromium.org/1552483002

Cr-Commit-Position: refs/heads/master@{#33138}

Addresses TODO by Dan --- simply by moving the check and exception
earlier in the function, before calling NewPromiseCapability() or
loading the constructor.

BUG=v8:4633
LOG=N
R=adamk@chromium.org, littledan@chromium.org, cbruni@chromium.org

Fixes 'test262/built-ins/Promise/prototype/then/context-check-on-entry'

Review URL: https://codereview.chromium.org/1561193002

Cr-Commit-Position: refs/heads/master@{#33137}

Several ports to enable r6 compact branch optimizations on MIPS64

Port 3573d3cb

Original commit message:
MIPS: r6 compact branch optimization.

Port bddf8c9e

Original commit message:
MIPS: Fix trampoline pool handling in MacroAssembler::BranchShort()

Port 6993cd0d

Original commit message:
MIPS: Fix 'MIPS:r6 compact branch optimization.'

Jic and jialc compact branch ops are fixed as they does
not have 'forbidden slot' restriction. Also COP1 branches
(CTI instructions) added to IsForbiddenAfterBranchInstr().

Port bb332195

Original commit message:
MIPS: Fix trampoline pool handling in MacroAssembler::BranchShort()

Port c91bcf71

Original commit message:
MIPS: Fix trampoline pool handling in MacroAssembler::BranchShort()
for r6.

BUG=

Review URL: https://codereview.chromium.org/1534183002

Cr-Commit-Position: refs/heads/master@{#33136}

The implementation temporarily modifies jssp to avoid needing a scratch
register, then restores it afterwards. However, the exception path
wasn't properly restoring the value.

With this patch, failures in this part of AssertStackConsistency get
reported properly (with backtrace and a BailoutReason).

BUG=

Review URL: https://codereview.chromium.org/1556993004

Cr-Commit-Position: refs/heads/master@{#33135}

Rolling v8/buildtools to 81863fe70639e85606b541d9d36e9e98c96b957e

Rolling v8/tools/clang to fe8d232767c63ce43873ffef101063a5791d171e

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1561063002

Cr-Commit-Position: refs/heads/master@{#33134}

This patch doesn't ship all features of ES2015 variable/scoping
changes, notably omitting the removal of legacy const. I think
function hoisting, let and class in sloppy mode can stand to
themselves as a package, and the legacy const change is much
riskier and more likely to be reverted, so my intention is to
pursue those as a separate, follow-on patch.

R=adamk@chromium.org
BUG=v8:4285,v8:3305
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1551443002

Cr-Commit-Position: refs/heads/master@{#33133}

Disabling a failing PPC wasm test.

BUG=
R=bbudge@chromium.org

Review URL: https://codereview.chromium.org/1561823002

Cr-Commit-Position: refs/heads/master@{#33132}

Disabling some tests for ppc, mips, arm.

BUG=
R=bbudge@chromium.org

Review URL: https://codereview.chromium.org/1564553002

Cr-Commit-Position: refs/heads/master@{#33131}

JIC and JIALC instructions do not have a forbidden slot so their
simulator implementation should not call CheckForbiddenSlot function.

BUG=

Review URL: https://codereview.chromium.org/1562473002

Cr-Commit-Position: refs/heads/master@{#33130}

Previously, it was `ToString(PromiseCast)`, which comes out as
"function resolve() { [native code] }". I had changed it to "Promise.resolve()",
but the other style is more consistently used.

LOG=N
R=cbruni@chromium.org, adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1560163002

Cr-Commit-Position: refs/heads/master@{#33129}

Correctly validate promise capabilities in NewPromiseCapabilities() and in
GetCapabilitiesExtractor(). Also explicitly follows Promise.race step 2 and
similar cases in the spec, rather than passing tests asserting these steps
are taken in NewPromiseCapability

Also changes Promise.reject to match specification.

Fixes the following test262 tests:

- built-ins/Promise/all/capability-executor-called-twice.js
- built-ins/Promise/all/capability-executor-not-callable.js
- built-ins/Promise/prototype/then/capability-executor-called-twice.js
- built-ins/Promise/prototype/then/capability-executor-not-callable.js
- built-ins/Promise/reject/capability-executor-called-twice.js
- built-ins/Promise/reject/capability-executor-not-callable.js
- built-ins/Promise/resolve/capability-executor-called-twice.js
- built-ins/Promise/resolve/capability-executor-not-callable.js
- built-ins/Promise/race/capability-executor-called-twice.js
- built-ins/Promise/race/capability-executor-not-callable.js
- built-ins/Promise/reject/S25.4.4.4_A3.1_T1.js
- built-ins/Promise/race/S25.4.4.3_A3.1_T2.js

Per v8:3641, mjsunit/es6/debug-promises/throw-with-undefined-reject.js becomes invalid. The exception is thrown before the chain handler is ever invoked, and is caught externally by d8's own handler --- thus evading the uncaught exception event.

BUG=v8:4633, v8:4631, v8:4243, v8:3641
LOG=N
R=littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1531073004

Cr-Commit-Position: refs/heads/master@{#33128}

BUG=

Review URL: https://codereview.chromium.org/1545013002

Cr-Commit-Position: refs/heads/master@{#33127}

Work around ppc assembler use of Mul, Div macros.

Disable several tests that fail for nosse4.
Disable several tests that fail for msan.

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1562513002

Cr-Commit-Position: refs/heads/master@{#33126}

This increases the size of addressable constant pool entries for jumps
to match other bytecodes using operands indexing the constant pool.

This change also introduces reservations for constant pool entries.
Reservations are used for forward jumps to ensure a constant pool entry
will be available when the jump target (label) is bound and the jump is
patched up in the bytecode array.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1546683002

Cr-Commit-Position: refs/heads/master@{#33125}

BUG=v8:811
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1558053002

Cr-Commit-Position: refs/heads/master@{#33124}