Reformatting Torque file is required to upload a CL
but it can only work on POSIX

Change-Id: I51283e3f6b29abf492be7efb5b8f10454d09fb37
Reviewed-on: https://chromium-review.googlesource.com/c/1475919Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59719}

... as it can be expensive and there are no users of it anymore (we
just read the information directly from ModuleInfo instead).

Bug: v8:8847
Change-Id: I30a3bec186fbdea3821979e642b27b3b827309ce
Reviewed-on: https://chromium-review.googlesource.com/c/1477220Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59718}

R=tebbi@chromium.org

Bug: v8:7793
Change-Id: I948b77a50cead2d031d007d06e9a4892a55b2408
Reviewed-on: https://chromium-review.googlesource.com/c/1477223Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59717}

This is a reland of 2d914c4c

Original change's description:
> [wasm] add wasm atomic wait callback test
>
> Bug=v8:8075
>
> Change-Id: I0c66acd329d0d6b67d34ad31c8ca401db38e0e5b
> Reviewed-on: https://chromium-review.googlesource.com/c/1377995
> Reviewed-by: Ben Smith <binji@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59709}

Change-Id: Ic95a99f73844a7243a9c4eaadecda8c1c6686798
Reviewed-on: https://chromium-review.googlesource.com/c/1478217Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59716}

This is a reland of 1a3a2bc3,
fixed an infinite loop in Map::TryUpdateSlow and added
a relevant test.

Original change's description:
> Fix accessor update of non-extensible maps.
>
> When installing getter/setter of non-extensible map with existing
> setter/getter of the same name, we introduce a new transition
> (so we have two transitions with the same name!). This triggers
> an assertion in map updater.
>
> This fix carefully checks that on the back-pointer path from
> non-extensible map to the extensible map there are only
> integrity level transitions. Otherwise, we just bail out.
>
> Bug: chromium:932953
> Change-Id: I02e91c3b652428a84a9f5c58b6691ea9b1fc44d6
> Reviewed-on: https://chromium-review.googlesource.com/c/1477067
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59667}

Bug: chromium:932953
Change-Id: I015ee3795f816c8eabb5b5c5cb0ee30f365cc972
Reviewed-on: https://chromium-review.googlesource.com/c/1477675Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59715}

Bug: v8:8844
Change-Id: Id0e52a3367d641205e2f1c67d610254708fd4494
Reviewed-on: https://chromium-review.googlesource.com/c/1470813Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59714}

WasmI64AtomicWait checked alignment at 32 bit instead of 64 bit.

Bug=v8:8075

Change-Id: Ibd668ad8440e928d14a1fcae1577c4aae345151b
Reviewed-on: https://chromium-review.googlesource.com/c/1475918Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59713}

Bug: v8:7684
Change-Id: I27586a06816863c71fc69342e8b4721ac0c32a0a
Reviewed-on: https://chromium-review.googlesource.com/c/1476293
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59712}

 https://chromium.googlesource.com/chromium/deps/icu.git/+log/07e7295d..960f195

The following change includes:

  960f195 Cherry-pick 3 locale fixes

Bug: v8:8242,v8:8260
Change-Id: I0b0641db5c75d2ce926dce0e30162f0f6c106ebe
Reviewed-on: https://chromium-review.googlesource.com/c/1476290Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59711}

This reverts commit 2d914c4c.

Reason for revert: broke ubsan https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8921056195305173456/+/steps/Check_-_extra/0/logs/WasmI64AtomicWaitCall../0

Original change's description:
> [wasm] add wasm atomic wait callback test
> 
> Bug=v8:8075
> 
> Change-Id: I0c66acd329d0d6b67d34ad31c8ca401db38e0e5b
> Reviewed-on: https://chromium-review.googlesource.com/c/1377995
> Reviewed-by: Ben Smith <binji@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59709}

TBR=binji@chromium.org,adamk@chromium.org,mstarzinger@chromium.org,aseemgarg@chromium.org,clemensh@chromium.org

Change-Id: I321d73d88d99430317cca42da39c22f9ba9888aa
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1475917Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59710}

Bug=v8:8075

Change-Id: I0c66acd329d0d6b67d34ad31c8ca401db38e0e5b
Reviewed-on: https://chromium-review.googlesource.com/c/1377995Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59709}

- Switch #define constant to static const
- Remove unnecessary Internal version of GetCategoryGroupEnabled()
- Fix a typo in a comment

Change-Id: I4af71dc62c7c4742bdfbcaa1ad336298eb325c42
Reviewed-on: https://chromium-review.googlesource.com/c/1477221Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59708}

This lets me run tests with --no-turbo-inlining without having to
worry about false positives.

Change-Id: Icf906e631ef5821136f397af141ba8b18334da7e
Reviewed-on: https://chromium-review.googlesource.com/c/1477730Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59707}

...to make things easier to read.

R=jarin@chromium.org

Change-Id: I0e53ef67e34f696b5977d4e091c7bc7bdf0ec145
Reviewed-on: https://chromium-review.googlesource.com/c/1477739Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59706}

Bug: chromium:933179
Change-Id: I511dfa7c060fd3f4e4b59c199a27a69d4cf81f97
Reviewed-on: https://chromium-review.googlesource.com/c/1477275Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59705}

This reverts commit 6202c445.

Reason for revert: times out on arm https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8921075891748393232/+/steps/Check_-_default/0/logs/console-profile-wasm/0

Original change's description:
> [inspector] Add wasm profiling test
> 
> This adds a first simple test to check that CPU profiles contain wasm
> function names.
> 
> R=​herhut@chromium.org, kozyatinskiy@chromium.org
> 
> Bug: v8:8783
> Change-Id: I26b1fd2b7ec555c073d80a464ee8a799b017b07a
> Reviewed-on: https://chromium-review.googlesource.com/c/1454597
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Stephan Herhut <herhut@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59703}

TBR=yangguo@chromium.org,kozyatinskiy@chromium.org,clemensh@chromium.org,herhut@chromium.org

Change-Id: Ib211a38a32ee08c18e4a19f05d9fc68d6a2d2901
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8783
Reviewed-on: https://chromium-review.googlesource.com/c/1475914Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59704}

This adds a first simple test to check that CPU profiles contain wasm
function names.

R=herhut@chromium.org, kozyatinskiy@chromium.org

Bug: v8:8783
Change-Id: I26b1fd2b7ec555c073d80a464ee8a799b017b07a
Reviewed-on: https://chromium-review.googlesource.com/c/1454597
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59703}

This removes an outdated section order check from {CreateNewBuffer} and
relies solely on the checks done in {ProcessSection}. Those checks are
more comprehensive and will remain coherent with synchronous decoding.

R=ahaas@chromium.org
TEST=mjsunit/regress/wasm/regress-8846
BUG=v8:8846

Change-Id: Id0cdc3bf3ad78f7970c9fceff66a17ab20f4666b
Reviewed-on: https://chromium-review.googlesource.com/c/1477211Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59702}

This is a reland of 932a5ca8

Original change's description:
> [heap] Enable large objects in young generation
>
> Bug: chromium:852420
> Change-Id: Id1cde3450c5ca046029b17eee5dbe5132f299c3d
> Reviewed-on: https://chromium-review.googlesource.com/c/1477212
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59669}

Bug: chromium:852420
Change-Id: If6dc439e410542da72c3edc08c9926b3edd1186e
Reviewed-on: https://chromium-review.googlesource.com/c/1477736Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59701}

Also disables tests in Lite mode that currently fail with lazy source
positions.

Bug: v8:8510
Change-Id: Id27b7cb31682559173b137ef51eaf06d517ee9ec
Reviewed-on: https://chromium-review.googlesource.com/c/1477129
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59700}

R=jgruber@chromium.org

Change-Id: I03c1aec177c389bf4d6550a26ad30d870e10135a
Reviewed-on: https://chromium-review.googlesource.com/c/1477738
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59699}

This adds a new hint type for live ranges that allows the control
flow aware allocation to hint the register that should be used on
reload. Avoid unnecessary register to register moves and helps
with code size.

Change-Id: I01e870514446eab3bffb89b2e00644bd215b81d5
Reviewed-on: https://chromium-review.googlesource.com/c/1460944Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59698}

This allows non-monolithic embedders to always allocate memory
for ArrayBuffer instances using the right allocation method.

This is based on a patch that Electron is currently using.

Refs: https://github.com/electron/electron/blob/1898f9162073910c05958295c612deec6121a892/patches/common/v8/array_buffer.patch
Change-Id: I39a614343118a0594aab48699a99cc2aad5b7ba9
Reviewed-on: https://chromium-review.googlesource.com/c/1462003Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59697}

The allocation observer step should be called only after the page flags
of the young large object are properly set up.

Bug: chromium:852420
Change-Id: I9f537a7c1d6b7aa15ccbe58006e3957a2ec2ab5c
Reviewed-on: https://chromium-review.googlesource.com/c/1477735Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59696}

This fixes ~15 debug/inspector tests that were failing when
v8_enable_lazy_source_positions = true.

Bug: v8:8510
Change-Id: Ica02aa2ea84549b5cddd82b5b98835829f7b0f1b
Reviewed-on: https://chromium-review.googlesource.com/c/1477280
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59695}

This change will enable basic "goto definition" support in the upcoming
Torque language server.

R=tebbi@chromium.org

Bug: v8:7793
Change-Id: I8e50cc58288991a2f6024d06bf38f4fd66f21eea
Reviewed-on: https://chromium-review.googlesource.com/c/1477055
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59694}

These are supported by the try bots but were missing from the set.

NOTRY=true

Change-Id: Ie12801ee953b14a7f94588efc64b8c57caa6d720
Reviewed-on: https://chromium-review.googlesource.com/c/1477052Reviewed-by: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59693}

Since the comments are copied from the std types anyway, we should also
point to them to make clear that the semantic is intentially equivalent.

Also, remove two unused methods and avoid an unneeded nullptr check.

R=mlippautz@chromium.org

Bug: v8:8834
Change-Id: Idcb5a1b8b2b3bb0786807828a96e085df963a8f0
Reviewed-on: https://chromium-review.googlesource.com/c/1477224Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59692}

R=clemensh@chromium.org
TEST=cctest/test-run-wasm-exceptions
BUG=v8:8729

Change-Id: I3751599bd72aaae1a9816e728437c64daf465f41
Reviewed-on: https://chromium-review.googlesource.com/c/1477733
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59691}

This reverts commit d74840b7.

Reason for revert: breaks stress sampling profiler

Original change's description:
> Reland "[heap] Enable large objects in young generation"
> 
> This is a reland of 932a5ca8
> 
> The GC stress failure was caused by v8:8801
> 
> Original change's description:
> > [heap] Enable large objects in young generation
> >
> > Bug: chromium:852420
> > Change-Id: Id1cde3450c5ca046029b17eee5dbe5132f299c3d
> > Reviewed-on: https://chromium-review.googlesource.com/c/1477212
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#59669}
> 
> Bug: chromium:852420
> Change-Id: I1fd28869f21715798fe49508efb7f3a622803ffc
> Reviewed-on: https://chromium-review.googlesource.com/c/1477218
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59683}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: Ieb81de35df1ccb9ef5c6d59c13f34ba294b848ed
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:852420
Reviewed-on: https://chromium-review.googlesource.com/c/1477732Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59690}

These are no longer needed now that JS builtins have been fully
removed.

The internal match usage in assert.js has been replaced by a custom
miniparser. The internal replace use in various string builtins was
replaced by manual global string replacement in a runtime function.

Bug: v8:8842,v8:7624
Change-Id: Ieb49c694662a13e84fd9fd2fe5d0412b8e0574da
Reviewed-on: https://chromium-review.googlesource.com/c/1473030Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59689}

Bug: chromium:926189
Change-Id: Ibd90f3cfdb37f07f3668f9ad79cff6e4305dc874
Reviewed-on: https://chromium-review.googlesource.com/c/1477674Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59688}

NOTRY=true

Bug: chromium:853202
Change-Id: Ieafb30e2aebedcab3e62c2659e7d093399068fb2
Reviewed-on: https://chromium-review.googlesource.com/c/1477222Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59687}

R=mslekova@chromium.org

Bug: v8:7790
Change-Id: I8866ac4a386d535e7c6c00454d93236340ea4fc3
Reviewed-on: https://chromium-review.googlesource.com/c/1477282Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59686}

Fixes cctest/test-cpu-profiler/DetailedSourcePositionAPI by ensuring
that source positions are available when starting an optimize job when
NeedsDetailedOptimizedCodeLineInfo is set. Also collects source
positions when inlining functions and adds a new test for this.

Bug: v8:8510
Change-Id: I9d84e37f3c8b638db080f6ec4b6633cdd7e3ee2f
Reviewed-on: https://chromium-review.googlesource.com/c/1472634Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59685}

The histogram is not used anymore. Remove to safe resources.

Bug: chromium:926072
Change-Id: I929f34f7ab0613431eaf9740f3342b6b2cec6cbd
Reviewed-on: https://chromium-review.googlesource.com/c/1477672Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59684}

This is a reland of 932a5ca8

The GC stress failure was caused by v8:8801

Original change's description:
> [heap] Enable large objects in young generation
>
> Bug: chromium:852420
> Change-Id: Id1cde3450c5ca046029b17eee5dbe5132f299c3d
> Reviewed-on: https://chromium-review.googlesource.com/c/1477212
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59669}

Bug: chromium:852420
Change-Id: I1fd28869f21715798fe49508efb7f3a622803ffc
Reviewed-on: https://chromium-review.googlesource.com/c/1477218Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59683}

Updates CloneIC builtin to take the CloneIC_slow path when there is no
feedback vector. Also fixes the CloneIC_Slow to handle proxies correctly.

StoreInArrayLiteralIC doesn't change the behaviour but just makes it
consistent with other ICs.

Bug: v8:8293
Change-Id: Ib824b3ef06db1595ce06f04669857bb957cbe072
Reviewed-on: https://chromium-review.googlesource.com/c/1475750
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59682}

to kTaggedSize or kSystemPointerSize.

Like X64's CLs, but combined:
https://chromium-review.googlesource.com/c/v8/v8/+/1384092
https://chromium-review.googlesource.com/c/v8/v8/+/1384309 and
https://chromium-review.googlesource.com/c/v8/v8/+/1473291

Bug: v8:8477, v8:8834
Change-Id: I832999996a0b56bd34ec6aa4fd86d9a5476e1065
Reviewed-on: https://chromium-review.googlesource.com/c/1477215
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59681}

This reverts commit 1a3a2bc3.

Reason for revert: Only CL in a reverted roll (https://chromium-review.googlesource.com/c/chromium/src/+/1477147)

Original change's description:
> Fix accessor update of non-extensible maps.
> 
> When installing getter/setter of non-extensible map with existing
> setter/getter of the same name, we introduce a new transition
> (so we have two transitions with the same name!). This triggers
> an assertion in map updater.
> 
> This fix carefully checks that on the back-pointer path from
> non-extensible map to the extensible map there are only
> integrity level transitions. Otherwise, we just bail out.
> 
> Bug: chromium:932953
> Change-Id: I02e91c3b652428a84a9f5c58b6691ea9b1fc44d6
> Reviewed-on: https://chromium-review.googlesource.com/c/1477067
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59667}

TBR=jarin@chromium.org,ishell@chromium.org

Change-Id: I9264423c605cebef87beb6c0f066e90b59faae48
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:932953
Reviewed-on: https://chromium-review.googlesource.com/c/1477219Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59680}