Reland [arm64][turbofan]: Handle any immediate shift.

With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179893003

Cr-Commit-Position: refs/heads/master@{#28977}

[turbofan] Prefer add/shift over madd on ARM64

Before selecting multiply-accumulate for a multiplication with add operation,
check that the multiply can't be reduced to add-with-shift. This prevents
simple multiplications by 3, 5, etc turning into register moves and madd
instructions.

Review URL: https://codereview.chromium.org/1180863002

Cr-Commit-Position: refs/heads/master@{#28976}

[turbofan] Fix throwing conversion inserted by JSTypedLowering.

This fixes the graph wiring of implicit JSToNumber nodes inserted by
JSTypedLowering, to be correctly hooked into a surrounding exceptional
continuation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/try-binop,test262

Review URL: https://codereview.chromium.org/1178153004

Cr-Commit-Position: refs/heads/master@{#28975}

Update V8 DEPS.

Rolling v8/tools/clang to 8b3ed2cb2e2512fa1074043cea3ada1143b80f26

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1179113002

Cr-Commit-Position: refs/heads/master@{#28974}

Use LookupIterator in GetOldValue

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178123003

Cr-Commit-Position: refs/heads/master@{#28973}

Add ToObject call in Array.prototype.sort

The spec says ToObject is called on the receiver, and this is
observable if you call sort on a primitive. This patch trivially
adds the call and a test.

BUG=v8:4125
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1178193004

Cr-Commit-Position: refs/heads/master@{#28972}

[es6] Make sure we call add property when adding a new property

When setting a property using `super.prop = val` we need to use
add property if we are adding a new property and not set property.

BUG=493566
LOG=N
R=verwaest@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1161073002

Cr-Commit-Position: refs/heads/master@{#28971}

Remove ASSERT, this method can handle ExternalArrays just fine.

BUG=v8:4137
LOG=n
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1179983002.

Cr-Commit-Position: refs/heads/master@{#28970}

In Array.of and Array.from, fall back to DefineOwnProperty

%AddElement is not intended for objects which are not arrays, and
its behavior may go away with future refactorings. This patch gets
rid of it if the receiver of from or of is not the intrinsic Array
object.

Array.of and Array.from previously papered over failures in calling
[[DefineOwnProperty]] when setting array elements. This patch
makes them lead to exceptions, and adds tests to assert that
the appropriate exceptions are thrown.

BUG=v8:4168
R=adamk
CC=rossberg,verwaest
LOG=Y

Review URL: https://codereview.chromium.org/1181623003

Cr-Commit-Position: refs/heads/master@{#28969}

[es6] Bound function names

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind

Bound functions should have a name based on the function that was
bound.

BUG=N
LOG=N
R=adamk   CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1182513002

Cr-Commit-Position: refs/heads/master@{#28968}

Reland of Use the LookupIterator in SetAccessor (patchset #1 id:1 of https://codereview.chromium.org/1175323004/)

Reason: Didn't break anything

Original issue's description:
> Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)
>
> Reason for revert:
> Blocks reverting of https://codereview.chromium.org/1175973002
>
> Original issue's description:
> > Use the LookupIterator in SetAccessor
> >
> > BUG=v8:4137
> > LOG=n
> >
> > Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> > Cr-Commit-Position: refs/heads/master@{#28955}
>
> TBR=jkummerow@chromium.org,verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4137
>
> Committed: https://crrev.com/11dbd29de57b290ee8dac2a782a53f879beb416f
> Cr-Commit-Position: refs/heads/master@{#28956}

TBR=jkummerow@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181813002

Cr-Commit-Position: refs/heads/master@{#28967}

Revert of Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #1 id:1 of https://codereview.chromium.org/1179933002/)

Reason for revert:
Reland, this didn't break anything.

Original issue's description:
> Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)
>
> Reason for revert:
> It broke webkit_unit_tests
>
> Original issue's description:
> > Remove GetAttributes from the mix to avoid another virtual dispatch.
> >
> > BUG=chromium:495949,v8:4137
> > LOG=n
> >
> > Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> > Cr-Commit-Position: refs/heads/master@{#28953}
>
> TBR=verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:495949,v8:4137
>
> Committed: https://crrev.com/ae639d2ad646237e2f413259a0f116845ef96440
> Cr-Commit-Position: refs/heads/master@{#28958}

TBR=ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1182603002

Cr-Commit-Position: refs/heads/master@{#28966}

Restore ExecutableAccessorInfoHandling for now

BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1173283004.

Cr-Commit-Position: refs/heads/master@{#28965}

Decompiler improvements.

The main motivation is simplifying profiling activities:

1) Use hex instead of decimal for offsets, just like perf does. This
affects --print-opt-code

2) When printing block information, indicate loop information: if
block is header, where the end is; if block is in a loop, where the
loop starts. This affects --code-comments.

Using --print-opt-code --code-comments, and cross-referencing with data
obtained from perf, one may now find the block a hotspot belongs to
without needing to do hex2dec/dec2hex conversions. Once found, loop info
is available locally, on the block.

BUG=

Review URL: https://codereview.chromium.org/1177123002

Cr-Commit-Position: refs/heads/master@{#28964}

Use LookupIterator for elements in the observed part of DefineAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1177103003

Cr-Commit-Position: refs/heads/master@{#28963}

Use LookupIterator for elements in GetAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178083002

Cr-Commit-Position: refs/heads/master@{#28962}

Bound functions should also have configurable length

BUG=v8:4116
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1180873002

Cr-Commit-Position: refs/heads/master@{#28961}

PPC: smi test optimization

R=mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1177263002

Cr-Commit-Position: refs/heads/master@{#28960}

Reconfigure on the right holder, which might be a hidden object.

BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1178953003.

Cr-Commit-Position: refs/heads/master@{#28959}

Revert of Remove GetAttributes from the mix to avoid another virtual dispatch. (patchset #2 id:40001 of https://codereview.chromium.org/1175973002/)

Reason for revert:
It broke webkit_unit_tests

Original issue's description:
> Remove GetAttributes from the mix to avoid another virtual dispatch.
>
> BUG=chromium:495949,v8:4137
> LOG=n
>
> Committed: https://crrev.com/2269b8b5a696bf4eef13590093151bff624d4175
> Cr-Commit-Position: refs/heads/master@{#28953}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:495949,v8:4137

Review URL: https://codereview.chromium.org/1179933002

Cr-Commit-Position: refs/heads/master@{#28958}

Revert of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)

Reason for revert:
Blocks revert of https://codereview.chromium.org/1175973002

Original issue's description:
> Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.
>
> @yangguo: please look at the debugger part of the CL.
> @ishell: please look at the rest.
>
> Additionally:
> - Ensure the LookupIterator for named properties does not accidentally get indexes in.
> - Fix the return value for typed array assignments to be the incoming value.
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/15aa811f8fe2708a757c3b53ca89db736aa8b222
> Cr-Commit-Position: refs/heads/master@{#28954}

TBR=yangguo@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181733002

Cr-Commit-Position: refs/heads/master@{#28957}

Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)

Reason for revert:
Blocks reverting of https://codereview.chromium.org/1175973002

Original issue's description:
> Use the LookupIterator in SetAccessor
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> Cr-Commit-Position: refs/heads/master@{#28955}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1175323004

Cr-Commit-Position: refs/heads/master@{#28956}

Use the LookupIterator in SetAccessor

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178673003

Cr-Commit-Position: refs/heads/master@{#28955}

Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.

@yangguo: please look at the debugger part of the CL.
@ishell: please look at the rest.

Additionally:
- Ensure the LookupIterator for named properties does not accidentally get indexes in.
- Fix the return value for typed array assignments to be the incoming value.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178503004

Cr-Commit-Position: refs/heads/master@{#28954}

Remove GetAttributes from the mix to avoid another virtual dispatch.

BUG=chromium:495949,v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1175973002

Cr-Commit-Position: refs/heads/master@{#28953}

X87:  [strong] Refactor ObjectStrength into a replacement for strong boolean args

port dd8544495109804c632bfbcefc3c5c701e0a8c43 (r28839)

original commit message:

    Boolean "is_strong" parameters have begun to proliferate across areas where
    strong mode semantics are different. This CL repurposes the existing
    ObjectStrength enum as a replacement for them.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173973002

Cr-Commit-Position: refs/heads/master@{#28952}

X87: Vector ICs: ClassLiterals need to allocate a vector slot for home objects.

port b27016b78a7dd58dc682eed51500ba603b3e46b0 (r28827).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1178533002

Cr-Commit-Position: refs/heads/master@{#28951}

X87: Vector ICs: debugger should save registers for vector store ics.

port bd32a9f711cb14c2b7c34512d43e78bd24960124 (r28825).

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173963002

Cr-Commit-Position: refs/heads/master@{#28950}

X87: Refactor lexical home object binding.

port 345fa142a9fca4b468417350ac26f61101d626e8 (r28802).

    port of r28769 overwrite some of r28802 so we port them again.

original commit message:

    Before this we had 3 super related lexical bindings that got injected
    into method bodies: .home_object, .this_function,  and new.target.
    With this change we get rid of the .home_object one in favor of using
    .this_function[home_object_symbol] which allows some simplifications
    throughout the code base.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1173933005

Cr-Commit-Position: refs/heads/master@{#28949}

X87: [date] Refactor the %_DateField intrinsic to be optimizable.

port e4782a9b468258344d512a5f7dadbf1584928849 (r28782)

original commit message:

    Previously the %_DateField intrinsic would also check the object and
    throw an exception if you happen to pass something that is not a valid
    JSDate, which (a) violates our policy for instrinsics and (b) is hard to
    optimize in TurboFan (even Crankshaft has a hard time, but there we will
    never inline the relevant builtins, so it doesn't show up). The throwing
    part is now a separate intrinsics %_ThrowIfNotADate that throws an
    exception in full codegen and deoptimizes in Crankshaft, which means the
    code for the current use cases is roughly the same (modulo some register
    renamings/gap moves).

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1174913002

Cr-Commit-Position: refs/heads/master@{#28948}

Fix GCMole issue

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1178883003

Cr-Commit-Position: refs/heads/master@{#28947}

Use the LookupIterator for SetElement and friends

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1172683003

Cr-Commit-Position: refs/heads/master@{#28946}

[turbofan] Merge sar/shr into MulHigh on ARM64

Merge a following arithmetic or logical right shift into the existing shift
of ARM64's Int32MulHigh or Uint32MulHigh code.

BUG=

Review URL: https://codereview.chromium.org/1179503003

Cr-Commit-Position: refs/heads/master@{#28945}

Revert of [arm64][turbofan]: Handle any immediate shift. (patchset #1 id:1 of https://codereview.chromium.org/1179733004/)

Reason for revert:
Breaks InstructionSelectorTest.Word64ShrWithWord64AndWithImmediate on debug builds (but not optdebug builds). I'll investigate.

Original issue's description:
> [arm64][turbofan]: Handle any immediate shift.
>
> With this patch, we can generate simple immediate-shift instructions for
> immediates outside the range "0 <= imm < width". Several related
> instruction selectors have also been updated accordingly.
>
> Example of generated code:
>
>     ---- Before ---         ---- After ----
>     movz w0, #33            lsr w0, w1, #1
>     lsr  w0, w1, w0
>
> BUG=
>
> Committed: https://crrev.com/36d771bbfa4af5efcc1c1dcf5b234445cb7ee722
> Cr-Commit-Position: refs/heads/master@{#28943}

TBR=bmeurer@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1176393002

Cr-Commit-Position: refs/heads/master@{#28944}

[arm64][turbofan]: Handle any immediate shift.

With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179733004

Cr-Commit-Position: refs/heads/master@{#28943}

[turbofan] Materialize all from non-writable roots from root array.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1175113005

Cr-Commit-Position: refs/heads/master@{#28942}

[test] Skip slow test.

NOTRY=true

Review URL: https://codereview.chromium.org/1179693005

Cr-Commit-Position: refs/heads/master@{#28941}

[turbofan] Structure AccessBuilder interface a bit.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1178103002

Cr-Commit-Position: refs/heads/master@{#28940}

Always print external time in --trace-gc to make it toolable.

BUG=

Review URL: https://codereview.chromium.org/1173243003

Cr-Commit-Position: refs/heads/master@{#28939}

Add extras test for calling into runtime.

The alternative of passing an object template at context creation is
unfeasible because we need a context to instantiate the template.
At the time we create the context from snapshot or bootstrap from
scratch, we would already need that template instance, leading to a
chicken-and-egg problem.

This is an alternative that is simpler and less intrusive.

R=domenic@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/1182443002

Cr-Commit-Position: refs/heads/master@{#28938}

[turbofan] Disable failing test262 tests after 84f208949b2e.

TBR=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1178123002

Cr-Commit-Position: refs/heads/master@{#28937}

[test] Add random seed stress mode to test runner.

NOTRY=true

Review URL: https://codereview.chromium.org/1180473003

Cr-Commit-Position: refs/heads/master@{#28936}

[turbofan] Enable support for try-catch statements.

R=bmeurer@chromium.org
BUG=v8:4131
LOG=N

Review URL: https://codereview.chromium.org/1177743002

Cr-Commit-Position: refs/heads/master@{#28935}

Revert of [heap] Unify the immortal immovable root detection mechanism. (patchset #3 id:40001 of https://codereview.chromium.org/1178853002/)

Reason for revert:
[Sheriff] tsan failures:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/4240

Original issue's description:
> [heap] Unify the immortal immovable root detection mechanism.
>
> Uniformly use the Heap::GetRootListIndex() and
> Heap::RootIsImmortalImmovable() methods to detect immortal immovable
> roots in the optimizing compilers.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/84e83da99a72edc169367bf88588b1a2f10c2e08
> Cr-Commit-Position: refs/heads/master@{#28933}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1178083003

Cr-Commit-Position: refs/heads/master@{#28934}

[heap] Unify the immortal immovable root detection mechanism.

Uniformly use the Heap::GetRootListIndex() and
Heap::RootIsImmortalImmovable() methods to detect immortal immovable
roots in the optimizing compilers.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1178853002

Cr-Commit-Position: refs/heads/master@{#28933}

Revert of Add CHECKs to verify that we never finalize stale copies of external strings (patchset #1 id:1 of https://codereview.chromium.org/1160253010/)

Reason for revert:
not needed anymore

Original issue's description:
> Add CHECKs to verify that we never finalize stale copies of external strings
>
> BUG=none
> R=ulan@chromium.org
> LOG=n
>
> Committed: https://crrev.com/ca2f8d811ca08783e38ce5dd42d38a6b6a7b876f
> Cr-Commit-Position: refs/heads/master@{#28811}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review URL: https://codereview.chromium.org/1178703008

Cr-Commit-Position: refs/heads/master@{#28932}

Revert of Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1181533006/)

Reason for revert:
[Sheriff] Changes/breaks layout tests. Please land upstream needsmanualrebaseline requests first or fix the tests.

E.g.
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/400
One test fails, one times out. See e.g. expectations changes:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Win/400/layout-test-results/inspector/sources/debugger-async/async-callstack-promises-diff.txt

On linux debug theses tests crash:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/346
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64__dbg_/346/layout-test-results/results.html

Original issue's description:
> Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)
>
> Reason for revert:
> Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.
>
> Original issue's description:
> > Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
> >
> > Reason for revert:
> > Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
> >
> > Original issue's description:
> > > Promise assimilation fix.
> > >
> > > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > > should call |y.then|, but the current implementation calls PromiseChain.
> > > We can see the difference when we set a custom function to |y.then|.
> > >
> > > This CL fixes the spec violation, but as a result |then| is no longer
> > > a wrapper of |chain| and in some cases it does not work well with
> > > |accept| or |chain|. That is not a problem for ES6 promise users because
> > > ES6 promise doesn't have them.
> > >
> > > LOG=N
> > > BUG=477921
> > >
> > > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > > Cr-Commit-Position: refs/heads/master@{#28926}
> >
> > TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=477921
> >
> > Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> > Cr-Commit-Position: refs/heads/master@{#28927}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/6f214bdd8bcdc76d48bd85c3bd897f0e2427ff95
> Cr-Commit-Position: refs/heads/master@{#28928}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181603003

Cr-Commit-Position: refs/heads/master@{#28931}

Whitespace change to test infra change.

Cr-Commit-Position: refs/heads/master@{#28930}

Revert of Re-land: Enable external startup by default on Linux. (patchset #3 id:40001 of https://codereview.chromium.org/1041683002/)

Reason for revert:
Revert, due to problems with stale build artefacts uncovered by this.

Details: https://code.google.com/p/v8/issues/detail?id=4171

Original issue's description:
> Re-land: Enable external startup by default on Linux.
>
> crrev.com/1016603004 should have fixed the issues that broke this last time.
>
> Notes:
> - The current functionality is meant to stay. If you prefer the old way,
>   just set v8_use_external_startup_data=0.
> - You might notice this if you call d8 via PATH. Either explicitly tell d8
>   where your external snapshot/built-ins are, or change the build options
>   as above.
> - This follows Chromium practice, that mostly uses this feature these days.
> - Other platforms to follow later.
>
> BUG=
>
> Committed: https://crrev.com/bb9c774c164c3552b67b4f1b60809852a44f2ecd
> Cr-Commit-Position: refs/heads/master@{#28858}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1177883003

Cr-Commit-Position: refs/heads/master@{#28929}

Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)

Reason for revert:
Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.

Original issue's description:
> Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
>
> Reason for revert:
> Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
>
> Original issue's description:
> > Promise assimilation fix.
> >
> > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > should call |y.then|, but the current implementation calls PromiseChain.
> > We can see the difference when we set a custom function to |y.then|.
> >
> > This CL fixes the spec violation, but as a result |then| is no longer
> > a wrapper of |chain| and in some cases it does not work well with
> > |accept| or |chain|. That is not a problem for ES6 promise users because
> > ES6 promise doesn't have them.
> >
> > LOG=N
> > BUG=477921
> >
> > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > Cr-Commit-Position: refs/heads/master@{#28926}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> Cr-Commit-Position: refs/heads/master@{#28927}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181533006

Cr-Commit-Position: refs/heads/master@{#28928}

Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)

Reason for revert:
Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829

Original issue's description:
> Promise assimilation fix.
>
> Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> should call |y.then|, but the current implementation calls PromiseChain.
> We can see the difference when we set a custom function to |y.then|.
>
> This CL fixes the spec violation, but as a result |then| is no longer
> a wrapper of |chain| and in some cases it does not work well with
> |accept| or |chain|. That is not a problem for ES6 promise users because
> ES6 promise doesn't have them.
>
> LOG=N
> BUG=477921
>
> Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> Cr-Commit-Position: refs/heads/master@{#28926}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1176163004

Cr-Commit-Position: refs/heads/master@{#28927}

Promise assimilation fix.

Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
should call |y.then|, but the current implementation calls PromiseChain.
We can see the difference when we set a custom function to |y.then|.

This CL fixes the spec violation, but as a result |then| is no longer
a wrapper of |chain| and in some cases it does not work well with
|accept| or |chain|. That is not a problem for ES6 promise users because
ES6 promise doesn't have them.

LOG=N
BUG=477921

Review URL: https://codereview.chromium.org/1098663002

Cr-Commit-Position: refs/heads/master@{#28926}

Make sure we do not start incremental marking in idle notification when incremental marking is turned off via flags.

BUG=chromium:498315
LOG=n

Review URL: https://codereview.chromium.org/1177953002

Cr-Commit-Position: refs/heads/master@{#28925}

PPC64: Adjust simulator stack safety margin.

This fixes a failure in test/mjsunit/regress/regress-crbug-491062.js.

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com, svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1174693002

Cr-Commit-Position: refs/heads/master@{#28924}

Make writing of frame translation platform independent.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1175963002

Cr-Commit-Position: refs/heads/master@{#28923}

[turbofan] Record the SharedFunctionInfo of ALL inlined functions.

Previously we only recorded the SharedFunctionInfo of inlined functions
that had at least one (lazy) deopt point left at code generation time.

R=mstarzinger@chromium.org

Committed: https://chromium.googlesource.com/v8/v8/+/ffa0b4007cd7de0cfd6d37079ef360e3beeb5686

Review URL: https://codereview.chromium.org/1175953002

Cr-Commit-Position: refs/heads/master@{#28922}

[stl] Fix ZonePriorityQueue wrapper.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1179763002

Cr-Commit-Position: refs/heads/master@{#28921}

Revert of [turbofan] Record the SharedFunctionInfo of ALL inlined functions. (patchset #2 id:20001 of https://codereview.chromium.org/1175953002/)

Reason for revert:
Breaks Windows debug.

Original issue's description:
> [turbofan] Record the SharedFunctionInfo of ALL inlined functions.
>
> Previously we only recorded the SharedFunctionInfo of inlined functions
> that had at least one (lazy) deopt point left at code generation time.
>
> R=mstarzinger@chromium.org
>
> Committed: https://chromium.googlesource.com/v8/v8/+/ffa0b4007cd7de0cfd6d37079ef360e3beeb5686

TBR=mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1178683004

Cr-Commit-Position: refs/heads/master@{#28920}

[turbofan] Record the SharedFunctionInfo of ALL inlined functions.

Previously we only recorded the SharedFunctionInfo of inlined functions
that had at least one (lazy) deopt point left at code generation time.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1175953002.

Cr-Commit-Position: refs/heads/master@{#28919}

[turbofan] Make IfException projections consume effects.

This is needed in order to allow expansion of a throwing node into a
set of nodes that produce different effects for the successful and the
exceptional continuation.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1179543002

Cr-Commit-Position: refs/heads/master@{#28918}

Update V8 DEPS.

Rolling v8/third_party/icu to a05f412f70489b77da0ddeb8baa31c68e3eff2c6

Rolling v8/tools/clang to 69fd1b485a2b24c872bfa4759342076751c9d490

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1176273002

Cr-Commit-Position: refs/heads/master@{#28917}

[test] Skip all philip layout tests to fix OOM issue.

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1169813010

Cr-Commit-Position: refs/heads/master@{#28916}

[test] Speculatively skip some layout tests to fix OOM issue.

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1179573003

Cr-Commit-Position: refs/heads/master@{#28915}

[test] Speculatively skip layout test to fix OOM issue.

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1180523002

Cr-Commit-Position: refs/heads/master@{#28914}

MIPS: Skip test-heap/TestSizeOfRegExpCode

After https://codereview.chromium.org/1180433003 the code-size exceeeds
the limit for MIPS. We have some optimizations in place for MIPS64 that
will be ported back to MIPS, and will investigate other code-size
improvements so we can re-enable this test.

BUG=

Review URL: https://codereview.chromium.org/1166353005

Cr-Commit-Position: refs/heads/master@{#28913}

Increase the chance of printing a useful error when bootstrapping fails

Two changes:
  - In ReportBootstrappingException, if all we have is a string, it seems
    better to print that than nothing.
  - In Factory::NewError, there's no use trying to call into the builtins if
    compilation of the builtins is causing the exception (this currently
    results in a cryptic segfault if we trigger, say, a ReferenceError when
    executing builtins script during bootstrapping).

Review URL: https://codereview.chromium.org/1158013003

Cr-Commit-Position: refs/heads/master@{#28912}

Make RawMachineAssemblerTest emitting CFG always have a dummy End block

Frame Elider requires a sane CFG which should have such dummy end block.

BUG=

Review URL: https://codereview.chromium.org/1166293004

Cr-Commit-Position: refs/heads/master@{#28911}

[test] Speculatively skip layout test to fix OOM issue.

BUG=chromium:498689
LOG=n
NOTRY=true
TBR=sergiyb@chromium.org

Review URL: https://codereview.chromium.org/1173033003

Cr-Commit-Position: refs/heads/master@{#28910}

PPC: [deoptimizer] Basic support inlining based on SharedFunctionInfo.

Port cf21da7e485ac80b3071e477e5399a00ee2b365f

Original commit message:
Up until now we can only inline based on JSFunction, because of the way
the deoptimization works.  With this change we will be able to inline
based on the SharedFunctionInfo and materialize the JSFunction from a
literal or a stack slot when necessary.

R=bmeurer@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1174963004

Cr-Commit-Position: refs/heads/master@{#28909}

Support rest parameters in arrow functions

R=dslomov@chromium.org, rossberg@chromium.org
LOG=Y
BUG=v8:2700

Review URL: https://codereview.chromium.org/1178523002

Cr-Commit-Position: refs/heads/master@{#28908}

MIPS: Replace numeric_limits<>::lowest() in cctest-assembler*.cc

On Mac for the requested minimal version (10.5) only old stl (from gcc 4.2.1) can be used so unfortunately we can't use numeric_limits<>::lowest() which were added in 874c54e05e92e04590b1026b495108abfd6063b7

BUG=
TEST=cctest/test-assembler-mips64, cctest/test-assembler-mips

Review URL: https://codereview.chromium.org/1175463003

Cr-Commit-Position: refs/heads/master@{#28907}

[deoptimizer] Basic support inlining based on SharedFunctionInfo.

Up until now we can only inline based on JSFunction, because of the way
the deoptimization works.  With this change we will be able to inline
based on the SharedFunctionInfo and materialize the JSFunction from a
literal or a stack slot when necessary.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1169103004

Cr-Commit-Position: refs/heads/master@{#28906}

Deserializer: flush code objects in large object space.

R=ulan@chromium.org,jacob.bramley@arm.com

Review URL: https://codereview.chromium.org/1173013002

Cr-Commit-Position: refs/heads/master@{#28905}

[test] Use generator to accelerate test runner startup.

This saves >1s for mjsunit and >10s for test262.

Review URL: https://codereview.chromium.org/1174923002

Cr-Commit-Position: refs/heads/master@{#28904}

Reland [test] Refactoring - Let runner handle test IDs.

Reason for revert:
All build problems had other reasons.

Original issue's description:
> Revert of [test] Refactoring - Let runner handle test IDs. (patchset #1 id:1 of https://codereview.chromium.org/1168303007/)
>
> Reason for revert:
> [Sheriff] Revert until the tree is in a better state.
>
> Original issue's description:
> > [test] Refactoring - Let runner handle test IDs.
> >
> > This prepares for properly rerunning tests. Currently when
> > tests are rerun, the same test object is reused. This
> > will be changed in a follow up.
> >
> > Committed: https://crrev.com/f41a81b8a513fc360c500c066b74f223bc9c0223
> > Cr-Commit-Position: refs/heads/master@{#28864}
>
> TBR=jkummerow@chromium.org,tandrii@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/f83444a5f24381ec9ccc28b1e18e1e9370415bb2
> Cr-Commit-Position: refs/heads/master@{#28891}

TBR=jkummerow@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1179483002

Cr-Commit-Position: refs/heads/master@{#28903}

Reland II of 'Optimize trivial regexp disjunctions' CL 1176453002

This change rewrites regexps like (ab|ac|z|ad|ae|af) into (a[b-f]|z).  We can only reorder disjunctions like this for case-dependent regexps.  For case-independent regexps, the disjunctions should be pre-sorted for best results.

R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1180433003

Cr-Commit-Position: refs/heads/master@{#28902}

Revert of Revert of [test] Refactoring - Use subject/observer pattern for progress indicators. (patchset #1 id:1 of https://codereview.chromium.org/1163373005/)

Reason for revert:
All build problems had other causes.

Original issue's description:
> Revert of [test] Refactoring - Use subject/observer pattern for progress indicators. (patchset #3 id:40001 of https://codereview.chromium.org/1171943002/)
>
> Reason for revert:
> might break stuff
>
> Original issue's description:
> > [test] Refactoring - Use subject/observer pattern for progress indicators.
> >
> > This should prevent bugs caused by missing super calls in
> > overridden methods. The assumption is that methods of
> > different indicators are independent.
> >
> > Committed: https://crrev.com/fbe973ff1722a6158a5b2babce9c1a32d26a1d3b
> > Cr-Commit-Position: refs/heads/master@{#28866}
>
> TBR=jkummerow@chromium.org,tandrii@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/2a3962d9d2a7415378811f4d56522531332d5a3e
> Cr-Commit-Position: refs/heads/master@{#28869}

TBR=jkummerow@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1176863002

Cr-Commit-Position: refs/heads/master@{#28901}

X87: [es6] Super call in arrows and eval

port 4b8051a02ae9f765b7d803fc7986301abde36007 (r28769)

original commit message:

    This splits the SuperReference AST node into SuperPropertyReference and
    SuperCallReference. The super call reference node consists of three
    unresolved vars to this, new.target and this_function. These gets
    declared when the right function is entered and if it is in use. The
    variables gets assigned in FullCodeGenerator::Generate.

    This is a revert of the revert 88b1c9170a0293cbcc8bdaf57fbe12744b48d7e8

BUG=

Review URL: https://codereview.chromium.org/1163983002

Cr-Commit-Position: refs/heads/master@{#28900}

[turbofan] Small cleanup in VisitTryCatchStatement.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1176513004

Cr-Commit-Position: refs/heads/master@{#28899}

X87: Build ObjectLiteral constant properties in the numbering phase.

port 450002f3a105d4bb17fd3b1a9d9d54464c01d200 (r28749)

original commit message:

    It's necessary to do this in order to know how many type feedback vector slots
    we should allocate for the object literal.

BUG=

Review URL: https://codereview.chromium.org/1168563003

Cr-Commit-Position: refs/heads/master@{#28898}

[turbofan] Deprecate NodeProperties::ReplaceWithValue.

This deprecates the aforementioned mutator in favor of a simpler
NodeProperties::ReplaceUses that doesn't perform any relaxation.
Preparation for enabling support for try-catch statements.

R=bmeurer@chromium.org
TEST=unittests/NodePropertiesTest

Review URL: https://codereview.chromium.org/1172773003

Cr-Commit-Position: refs/heads/master@{#28897}

Fix copy-pasteo in expression-classifier.h

R=dslomov@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1174543003

Cr-Commit-Position: refs/heads/master@{#28896}

[test] Fix test archive clobber.

The old version would always clobber.

NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1177503005

Cr-Commit-Position: refs/heads/master@{#28895}

[test] Clobber unclean test262-es6 checkouts.

Review URL: https://codereview.chromium.org/1173753004

Cr-Commit-Position: refs/heads/master@{#28894}

Bring back high promotion mode to shrink young generation size when scavenging latency is high.

BUG=

Review URL: https://codereview.chromium.org/1175663002

Cr-Commit-Position: refs/heads/master@{#28893}

Fix cluster-fuzz bug introduced in refs/heads/master@{#28796}.

Don't DCHECK when neutering that the buffer is not a SharedArrayBuffer;
instead, just return early.

BUG=chromium:498142,chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1174753002

Cr-Commit-Position: refs/heads/master@{#28892}

Revert of [test] Refactoring - Let runner handle test IDs. (patchset #1 id:1 of https://codereview.chromium.org/1168303007/)

Reason for revert:
[Sheriff] Revert until the tree is in a better state.

Original issue's description:
> [test] Refactoring - Let runner handle test IDs.
>
> This prepares for properly rerunning tests. Currently when
> tests are rerun, the same test object is reused. This
> will be changed in a follow up.
>
> Committed: https://crrev.com/f41a81b8a513fc360c500c066b74f223bc9c0223
> Cr-Commit-Position: refs/heads/master@{#28864}

TBR=jkummerow@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1167343003

Cr-Commit-Position: refs/heads/master@{#28891}

Revert of Update Test262 to 5/30 (patchset #4 id:60001 of https://codereview.chromium.org/1136553008/)

Reason for revert:
[Sheriff] Still lots of breakages on some builders. E.g. http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/3313

Original issue's description:
> Update Test262 to 5/30
>
> This updates the test runner to run all tests in both sloppy
> and strict mode.
>
> It also marks the test in the status file as failing in
> sloppy mode even if all it does is marking the test as
> [PASS, FAIL]. A future CL will have to validate that the
> tests pass and fail in the correct mode.
>
> Committed: https://crrev.com/d869f4a4801d4ef6868c266c07f9e29d2e29cba5
> Cr-Commit-Position: refs/heads/master@{#28879}

TBR=rossberg@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1173933002

Cr-Commit-Position: refs/heads/master@{#28890}

Revert of [test262-es6] Temporary disable some tests (patchset #1 id:1 of https://codereview.chromium.org/1176573002/)

Reason for revert:
[Sheriff] Prepares revert of https://codereview.chromium.org/1136553008

Original issue's description:
> [test262-es6] Temporary disable some tests
>
> These tests have issues with our harness.
>
> Upstream fix: https://github.com/tc39/test262/pull/309
>
> BUG=N
> LOG=N
> TBR=machenbach@chromium.org
>
> Committed: https://crrev.com/eed7363a0da0f21c3eee6c052507299d9b707462
> Cr-Commit-Position: refs/heads/master@{#28881}

TBR=arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1169903006

Cr-Commit-Position: refs/heads/master@{#28889}

[turbofan] Fix context chain extension for top-level code.

For top-level code the closure passed into context allocation methods
needs to be replaced with a sentinel to canonicalize is to the empty
function object.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4169
BUG=v8:4169
LOG=N

Review URL: https://codereview.chromium.org/1172013002

Cr-Commit-Position: refs/heads/master@{#28888}

[frames] No GC is allowed while using the unhandlified TranslatedState.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1174593003.

Cr-Commit-Position: refs/heads/master@{#28887}

Update V8 DEPS.

Rolling v8/third_party/icu to 45a095d561334871dd8673cf8e5cca330d33f521

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1178433002

Cr-Commit-Position: refs/heads/master@{#28886}

Revert of Reland of 'Optimize trivial regexp disjunctions' CL 1176453002 (patchset #2 id:20001 of https://codereview.chromium.org/1174713002/)

Reason for revert:
Tree looks like a Christmas tree and this isn't helping

Original issue's description:
> Reland of 'Optimize trivial regexp disjunctions' CL 1176453002
>
> Original code review: https://codereview.chromium.org/1176453002/
>
> TBR=yangguo@chromium.org
> BUG=chromium:482998
> LOG=n
>
> Committed: https://crrev.com/85fab0fa092e8d979413f6a61baec3abe26e568d
> Cr-Commit-Position: refs/heads/master@{#28884}

TBR=yangguo@chromium.org,erikcorry@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:482998

Review URL: https://codereview.chromium.org/1172893002

Cr-Commit-Position: refs/heads/master@{#28885}

Reland of 'Optimize trivial regexp disjunctions' CL 1176453002

Original code review: https://codereview.chromium.org/1176453002/

TBR=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1174713002

Cr-Commit-Position: refs/heads/master@{#28884}

Moar clobbering landmines

Bots have been really lazy today and they have not picked up the
latest versions for some obscure reason

BUG=N
LOG=M
TBR=machenbach@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1171223002

Cr-Commit-Position: refs/heads/master@{#28883}

Implement %TypedArray%.prototype.slice

The initial implementation of this method takes a couple shortcuts:
- At some points in the spec, we should be making a reference to
  "Table 49" and instead do property lookup on the constructor.
  This is an issue with some other TypedArray methods too.
- The spec indicates that, if constructor and @@species haven't been
  messed with in particular ways, then there should be a memcpy
  from the old to the new. That fast path is not implemented here
  in this patch, but because V8 doesn't canonicalize NaN, the result
  isn't observably different.

BUG=v8:3578
LOG=Y
R=arv

Review URL: https://codereview.chromium.org/1170023002

Cr-Commit-Position: refs/heads/master@{#28882}

[test262-es6] Temporary disable some tests

These tests have issues with our harness.

Upstream fix: https://github.com/tc39/test262/pull/309

BUG=N
LOG=N
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1176573002

Cr-Commit-Position: refs/heads/master@{#28881}

Make old generation allocation throughput stats independent from the new space allocation throughput.

BUG=

Review URL: https://codereview.chromium.org/1167563005

Cr-Commit-Position: refs/heads/master@{#28880}

Update Test262 to 5/30

This updates the test runner to run all tests in both sloppy
and strict mode.

It also marks the test in the status file as failing in
sloppy mode even if all it does is marking the test as
[PASS, FAIL]. A future CL will have to validate that the
tests pass and fail in the correct mode.

Review URL: https://codereview.chromium.org/1136553008

Cr-Commit-Position: refs/heads/master@{#28879}

Revert of Optimize trivial regexp disjunctions (patchset #10 id:180001 of https://codereview.chromium.org/1176453002/)

Reason for revert:
ASAN failure

Original issue's description:
> Optimize trivial regexp disjunctions
>
> R=yangguo@chromium.org
> BUG=chromium:482998
> LOG=n
>
> Committed: https://crrev.com/5f1f7c15b3207f6c51d187692690aeb09d3e36b5
> Cr-Commit-Position: refs/heads/master@{#28871}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:482998

Review URL: https://codereview.chromium.org/1174603002

Cr-Commit-Position: refs/heads/master@{#28878}