Version 1.18.1

Cherry-pick 5923966da3388666f5d7692f2876666cad8b9255 to stable
Cherry-pick 11d340c51d7d916c3c4068c341c6e5fe48a6bf40 to stable
Cherry-pick f3ad2b77cc2a76341c3aabcbf37e5d779b3d5d18 to stable
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 26425b5..ac4d76d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,16 @@
+## 1.18.0 - 2016-08-02
+
+Patch release, resolves two issues:
+
+* Debugger: Fixes a bug that crashes the VM
+(SDK issue [26941](https://github.com/dart-lang/sdk/issues/26941))
+
+* VM: Fixes an optimizer bug involving closures, try, and await
+(SDK issue [26948](https://github.com/dart-lang/sdk/issues/26948))
+
+* Dart2js: Speeds up generated code on Firefox
+(https://codereview.chromium.org/2180533002)
+
 ## 1.18.0 - 2016-07-27
 
 ### Core library changes
diff --git a/pkg/compiler/lib/src/js_emitter/full_emitter/emitter.dart b/pkg/compiler/lib/src/js_emitter/full_emitter/emitter.dart
index 5bd1cb1..6301e77 100644
--- a/pkg/compiler/lib/src/js_emitter/full_emitter/emitter.dart
+++ b/pkg/compiler/lib/src/js_emitter/full_emitter/emitter.dart
@@ -1067,9 +1067,28 @@
           var cls = function () {};
           cls.prototype = {'p': {}};
           var object = new cls();
-          return object.__proto__ &&
-                 object.__proto__.p === cls.prototype.p;
-         })();
+          if (!(object.__proto__ && object.__proto__.p === cls.prototype.p))
+            return false;
+    
+          try {
+            // Are we running on a platform where the performance is good?
+            // (i.e. Chrome or d8).
+
+            // Chrome userAgent?
+            if (typeof navigator != "undefined" &&
+                typeof navigator.userAgent == "string" &&
+                navigator.userAgent.indexOf("Chrome/") >= 0) return true;
+
+            // d8 version() looks like "N.N.N.N", jsshell version() like "N".
+            if (typeof version == "function" &&
+                version.length == 0) {
+              var v = version();
+              if (/^\d+\.\d+\.\d+\.\d+$/.test(v)) return true;
+            }
+          } catch(_) {}
+          
+          return false;
+        })();
       ''');
     }
 
diff --git a/pkg/compiler/lib/src/js_emitter/startup_emitter/fragment_emitter.dart b/pkg/compiler/lib/src/js_emitter/startup_emitter/fragment_emitter.dart
index 1b7beca..69e3dea 100644
--- a/pkg/compiler/lib/src/js_emitter/startup_emitter/fragment_emitter.dart
+++ b/pkg/compiler/lib/src/js_emitter/startup_emitter/fragment_emitter.dart
@@ -64,13 +64,9 @@
   }
 }
 
-var supportsDirectProtoAccess = (function () {
-  var cls = function () {};
-  cls.prototype = {'p': {}};
-  var object = new cls();
-  return object.__proto__ &&
-         object.__proto__.p === cls.prototype.p;
-})();
+// Only use direct proto access to construct the prototype chain (instead of
+// copying properties) on platforms where we know it works well (Chrome / d8).
+var supportsDirectProtoAccess = #directAccessTestExpression;
 
 var functionsHaveName = (function() {
   function t() {};
@@ -354,6 +350,36 @@
 })()
 ''';
 
+/// An expression that returns `true` if `__proto__` can be assigned to stitch
+/// together a prototype chain, and the performance is good.
+const String directAccessTestExpression = r'''
+  (function () {
+    var cls = function () {};
+    cls.prototype = {'p': {}};
+    var object = new cls();
+    if (!(object.__proto__ && object.__proto__.p === cls.prototype.p))
+      return false;
+    
+    try {
+      // Are we running on a platform where the performance is good?
+      // (i.e. Chrome or d8).
+
+      // Chrome userAgent?
+      if (typeof navigator != "undefined" &&
+          typeof navigator.userAgent == "string" &&
+          navigator.userAgent.indexOf("Chrome/") >= 0) return true;
+      // d8 version() looks like "N.N.N.N", jsshell version() like "N".
+      if (typeof version == "function" &&
+          version.length == 0) {
+        var v = version();
+        if (/^\d+\.\d+\.\d+\.\d+$/.test(v)) return true;
+      }
+    } catch(_) {}
+
+    return false;
+  })()
+''';
+
 /// Deferred fragments (aka 'hunks') are built similarly to the main fragment.
 ///
 /// However, at specific moments they need to contribute their data.
@@ -436,6 +462,7 @@
         program.holders.where((Holder holder) => !holder.isStaticStateHolder);
 
     return js.js.statement(mainBoilerplate, {
+      'directAccessTestExpression': js.js(directAccessTestExpression),
       'typeNameProperty': js.string(ModelEmitter.typeNameProperty),
       'cyclicThrow': backend.emitter
           .staticFunctionAccess(backend.helpers.cyclicThrowHelper),
diff --git a/runtime/vm/parser.cc b/runtime/vm/parser.cc
index c902639..babc538 100644
--- a/runtime/vm/parser.cc
+++ b/runtime/vm/parser.cc
@@ -9015,13 +9015,18 @@
     loop_var_name = ExpectIdentifier("variable name expected");
   }
   ExpectToken(Token::kIN);
+
+  // Ensure that the block token range contains the call to moveNext and it
+  // also starts the block at a different token position than the following
+  // loop block. Both blocks can allocate contexts and if they have a matching
+  // token position range, it can be an issue (cf. bug 26941).
+  OpenBlock();  // Implicit block around while loop.
+
   const TokenPosition collection_pos = TokenPos();
   AstNode* collection_expr =
       ParseAwaitableExpr(kAllowConst, kConsumeCascades, NULL);
   ExpectToken(Token::kRPAREN);
 
-  OpenBlock();  // Implicit block around while loop.
-
   // Generate implicit iterator variable and add to scope.
   // We could set the type of the implicit iterator variable to Iterator<T>
   // where T is the type of the for loop variable. However, the type error
@@ -9293,7 +9298,16 @@
     LocalVariable* rethrow_stack_trace_var) {
   TRACE_PARSER("EnsureFinallyClause");
   ASSERT(parse || (is_async && (try_stack_ != NULL)));
-  OpenBlock();
+  // Increasing the loop level prevents the reuse of a parent context and forces
+  // the allocation of a local context to hold captured variables declared
+  // inside the finally clause. Otherwise, a captured variable gets allocated at
+  // different slots in the parent context each time the finally clause is
+  // reparsed, which is done to duplicate the ast. Since only one closure is
+  // kept due to canonicalization, it will access the correct slot in only one
+  // copy of the finally clause and the wrong slot in all others. By allocating
+  // a local context, all copies use the same slot in different local contexts.
+  // See issue #26948. This is a temporary fix until we eliminate reparsing.
+  OpenLoopBlock();
   if (parse) {
     ExpectToken(Token::kLBRACE);
   }
diff --git a/tests/language/regress_26948_test.dart b/tests/language/regress_26948_test.dart
new file mode 100644
index 0000000..7e323f7
--- /dev/null
+++ b/tests/language/regress_26948_test.dart
@@ -0,0 +1,26 @@
+// Copyright (c) 2016, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+// VMOptions=--optimization-counter-threshold=10 --no-background-compilation
+
+import 'dart:async';
+import "package:expect/expect.dart";
+
+void check(Function f) {
+  Expect.isTrue(f());
+}
+
+Future doSync() async {
+   try {
+     await 123;
+  } finally {
+    var next = 5.0;
+    check(() => next == 5.0);
+  }
+}
+
+main() async {
+  for (int i = 0; i < 20; i++) {
+    await doSync();
+  }
+}
diff --git a/tools/VERSION b/tools/VERSION
index 6318e03..8c51c08 100644
--- a/tools/VERSION
+++ b/tools/VERSION
@@ -26,6 +26,6 @@
 CHANNEL stable
 MAJOR 1
 MINOR 18
-PATCH 0
+PATCH 1
 PRERELEASE 0
 PRERELEASE_PATCH 0