Currently the function normalizes only old sparse backing stores.
This patch removed the age check to decouple the heuristic from GC.

Change-Id: I9b7f787315b2b8facfa35358143173f7d207c8da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846897Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74156}

Change-Id: Ia3d7933fc415d2756e1db1c1f96828d9e6f8c28e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848461Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74155}

This is a reland of df4dae77

Revert reason looks like an unrelated existing flake (https://crbug.com/v8/11634)

Original change's description:
> [arm] Make the constant pool check deadline smarter
>
> Rather than having periodic constant pool checks that almost always fail
> (because the constant pool deadline isn't close enough, or even because
> there's no constant pool to emit at all), set a single deadline on the
> first constant pool insertion which expires just before the maximum
> distance to the constant pool. Constant pool checks around unconditional
> jumps happen irrespective of this deadline.
>
> In particular, this is made possible by fixing the incorrect assumption
> that the constant pool can be emitted out of order. The new assumption
> (that the emission is in-order) is validated with a CHECK.
>
> Bug: v8:11420
> Change-Id: I061dd0b8c3476ba95ee1acfb3b485d8ba2adda91
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844665
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74141}

Bug: v8:11420
Change-Id: I1cc5ca9082da26ab225dee8d8ea22c385c6cc1d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848468
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74154}

We could end up in a baseline entry trampoline without having
baseline code, because of an unhandled interaction in the debugger
(discarding baseline code) and the deoptimizer.

Bug: chromium:1199681
Change-Id: Ia33bb4d64903dd989728465b3d83a88b84597a8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843820Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74153}

This removes atomicops_internals_portable.h and inlines
atomicops_internals_std.h into atomicops.h.

Change-Id: Id06cae42a277fee9379590ca755571193f9e8bbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848462Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74152}

The ToString intrinsic isn't used anymore, since there is now a ToString
bytecode, so we can remove it.

Change-Id: I5ed121ae4d117660e1ee8a64a2b30e1fb054a886
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848465
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74151}

Bug: chromium:1056170
Change-Id: Id3456a36e05379a517f5c49ea0252caa91221519
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848466Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74150}

Bug: chromium:1196278
Change-Id: If80b1264f537e3828867831ac4d4dfc005a1ae8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2845243
Auto-Submit: Nico Weber <thakis@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74149}

Prior to this patch, the RemoteObject for e.g. `/x/d` got a
`description` that omitted the new `d` (`hasIndices`) flag.

Bug: v8:11684, v8:9548
Change-Id: I774fbd9620c6f3f2f19b819c9009fab7cc2e3229
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848460Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74148}

This CL applies the following changes:
- JSCallReducer no longer generates a CheckBigInt in front of the
  generated BigIntAsUintN.
- This results in a slight change of the semantics of the latter, which
  now includes the necessary type check. Typer and Verifier are changed
  accordingly.
- The BigIntAsUintN operator is now effectful, since it can now deopt.
- IrOpcode::kBigIntAsUintN is now lowered in SimplifedLowering instead
  of EffectControlLinearizer, the necessary type check is introduced
  by the RepresentationChanger.
- Adds a small mjsunit test to check the correct deoptimization behavior
  of optimized BigInt.asUintN.
==> Remove UseInfo::TruncatingWord64()!

Drive-by: Fix an issue in ChangeUnaryToPureBinaryOp when the new_input
is at index 1.
Drive-by: Introduce an %Is64Bit() intrinsic to allow tests to
distinguish 32 and 64 bit architectures.

Bug: v8:11682
Change-Id: I448f892d3bd2280d731ae5b248c833de8faf1bd5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843816
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74147}

Change-Id: Ibfbb306d52092bc9e9564d1e1b2d1cb7f7edfbb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844662
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74146}

Bug: chromium:1195650
Change-Id: Ia18c053d54aa62ecafc387688dfb57ee63d2a09c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831490Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74145}

This reverts commit df4dae77.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Arm%20-%20debug/18512/overview

Original change's description:
> [arm] Make the constant pool check deadline smarter
>
> Rather than having periodic constant pool checks that almost always fail
> (because the constant pool deadline isn't close enough, or even because
> there's no constant pool to emit at all), set a single deadline on the
> first constant pool insertion which expires just before the maximum
> distance to the constant pool. Constant pool checks around unconditional
> jumps happen irrespective of this deadline.
>
> In particular, this is made possible by fixing the incorrect assumption
> that the constant pool can be emitted out of order. The new assumption
> (that the emission is in-order) is validated with a CHECK.
>
> Bug: v8:11420
> Change-Id: I061dd0b8c3476ba95ee1acfb3b485d8ba2adda91
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844665
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74141}

Bug: v8:11420
Change-Id: Ib822425749df33fb22a38d317c107a523b382e01
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846899
Auto-Submit: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74144}

Add missing resources to mjsunit/BUILD.gn and tickprocesser test.

Bug: v8:11681
Change-Id: I7ae8391f94913e376c93a40dd1f0ba16bff8dcc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844655Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74143}

JS-to-Wasm wrappers embed heap constants (like the undefined value), and
those heap values are being accessed during compilation for tracing.
This is not a data race, since those values are read-only. But if the
isolate dies while we are compiling those wrappers, we might read from
the heap after it has been free'd.

Ideally we would not access the isolate or the heap at all during
compilation, but delaying all tracing until the "finalization" phase is
not feasible, and removing the heap value printing from tracing would
significantly regress quality of this tracing.

Hence this CL only fixes the actual issue: That we keep compiling
wrappers when the isolate is already gone. It does so by introducing an
{OperationsBarrier} per isolate that is being taken by each thread that
executes wrapper compilation, and is used for waiting for background
threads to finish before the isolate shuts down.
Additionally, we actually cancel all compilation if a module dies (or
the isolate shuts down) before it finished baseline compilation. In this
state, the module cannot be shared between isolates yet, so it's safe to
fully cancel all compilation. This cancellation is not strictly
necessary, but it will reduce the time we are blocked while waiting for
wrapper compilation to finish (because no new compilation will start).

R=thibaudm@chromium.org
CC=manoskouk@chromium.org

Bug: v8:11626, chromium:1200231
Change-Id: I5b19141d22bd0cb00ba84ffa53fb07cf001e13cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846881Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74142}

Rather than having periodic constant pool checks that almost always fail
(because the constant pool deadline isn't close enough, or even because
there's no constant pool to emit at all), set a single deadline on the
first constant pool insertion which expires just before the maximum
distance to the constant pool. Constant pool checks around unconditional
jumps happen irrespective of this deadline.

In particular, this is made possible by fixing the incorrect assumption
that the constant pool can be emitted out of order. The new assumption
(that the emission is in-order) is validated with a CHECK.

Bug: v8:11420
Change-Id: I061dd0b8c3476ba95ee1acfb3b485d8ba2adda91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844665
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74141}

No-Try: true
Bug: chromium:1199430
Change-Id: I2a2b04fae6c647602a1471a0c9959324e15ad37e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846890Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74140}

BUG=v8:9684

Change-Id: Ia63928e67dd714690b4f54c14361c6ee5e81f604
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843809
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74139}

Bug: chromium:1056170
Change-Id: I64d817f9c5f56c0d7ae5a68ef3f00d3149548259
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846882Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74138}

`exectionContextId` parameter in Runtime.addBinding is not working
correctly and does not have a practical use case. Therefore,
deprecating it in favour of the `executionContextName` parameter that
better serves the purpose of exposing bindings to isolated worlds. We
expect most users to be able to migrate to `executionContextName`.

Bug: chromium:1169639
Change-Id: Ic37cefa6a62501c7e903923f1f9c0da7e51326c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844652Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Alex Rudenko <alexrudenko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74137}

Bug: chromium:1154223
Change-Id: I022818764091bbc0d3b03cfd11b58f40fe8091ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846889Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74136}

Untangles the non-tracing GC optimization (Scavenger) that allows for
dropping objects that are only reachable from certain API references
from EmbedderHeapTracer. Instead, allow setting it on Isolate.

This allows for using the optimization when using cppgc.

Chromium-side: https://crrev.com/c/2844587

Bug: chromium:1056170
Change-Id: I20f28dd84c808872c7f9559c8c168e828794dd1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844657Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74135}

Changes:
- Reintroduce CALL_INTERFACE() and use it over
  CALL_INTERFACE_IF_REACHABLE_AND_OK() in contexts where
  current_code_reachable_and_ok_ is known to hold.
- Add V8_LIKELY annotations.

Bug: chromium:1201718
Change-Id: I6a448a8955ecec20fdddef636d563cb1b5a93679
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846886Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74134}

Change-Id: Id1581981ac54c74216e5a7887b7972254237f319
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2847581Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74133}

Change-Id: I8301678b03439ce4d900c173c48d0373f44dbd4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2841887
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74132}

Bug: v8:11613
Change-Id: I25bf720164129c3d95ebc07d0c2a0f6e6b8ee9af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2847473Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74131}

Using the added lxvx and stxvx instructions, we can load and
store vector register values in a single instruction.
MRR encoding does not have a 16 byte alignment requirement.

Change-Id: I9c1d80fd867a0e79d3390e4a05e08cdf2a2e4835
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2845734Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74130}

Change-Id: I0277bd7de282449fde232777b0482cc52a2d0ef6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844995Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74129}

Bug: chromium:1056170
Change-Id: I0ccb8d3a67a21467e9145ddbff8514a6054d57fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843821
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74128}

This will make --regenerate_expected_files flag work for message tests.

Bug: v8:10773
Change-Id: Ica87bd69bd0a41e2a3c168d2200d0cd0c7f094da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2842387
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74127}

Bug: v8:11589
Change-Id: If92ef6d8ce49831818c797909a7655db8101d154
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2842263Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74126}

Doing a `!(B > A)` which is equal to `A >= B`. This way
we use one less instruction.

Change-Id: I49d50f11096e2d542eaabab82c17225c83e89b63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846980Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74125}

Change-Id: I33d7bdfc14af9ad169c79a3efd6af6ba2f2362c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814726
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#74124}

Port the recent arm64 simulator debugger improvements to arm:

  * [arm64/sim] Add a 'sim' gdb command
    https://crrev.com/c/2664448
  * [arm64/sim] Add a simple backtrace debug command
    https://crrev.com/c/2666688

Change-Id: Id58a49cfe8e643be0fb6718a0a149e2c7ea0bcaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844659
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74123}

Unordered floating-point (non-)equality is implemented using two flags
on x64: kUnorderedNotEqual as "not_equal OR parity_even" and
kUnorderedEqual as "equal AND parity_odd". Only the first flag was
checked.

This change fixes the kUnorderedNotEqual case by emitting a second
cmov to also move the "true" value if the parity_even flag is set. The
kUnorderedEqual case is covered by inverting the condition in the
instruction selector.

This should also be optimal according to the code emitted by clang -O3
for equivalent C++ code.

Drive-by: remove unused overload of EmitWithContinuation.

R=neis@chromium.org
CC=ahaas@chromium.org

Bug: chromium:1200184
Change-Id: Iae438d29fb5897ca910a154f140a5a6a904490ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844651
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74122}

Currently the --single-generation flags disables inline allocations
and forces all allocations to go via runtime where they are redirected
to the old generation.

This patch implements the young to old redirection in CSA and TF.

Bug: v8:11644
Change-Id: Ie945ba684fb0f41d5414a05be2f25245d4869d6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839010Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74121}

Until this CL, the JSHeapBroker::GetPropertyAccessInfo (GPAI) process
was as follows:

 1. GPAI is called on the main thread (MT) during the serialization
    phase to create and cache PAIs.
 2. GPAI is called again from the background thread (BT); only cached
    PAIs from step 1 are usable.

As part of concurrent inlining, the goal is to move GPAI fully to the
background thread. This CL takes a major step in that direction by
making GPAI itself callable from the BT without resorting solely to PAIs
that were previously cached on the MT.

There are two main reasons why GPAI previously had to run on the MT:

 a) Concurrent access to Maps and other heap objects.
 b) Serialization and creation of ObjectRefs for objects discovered
    during GPAI.

This CL addresses only reason a) and leaves b) for future work. This
is done by keeping the two-pass approach, s.t. the initial call of
GPAI on the MT discovers and serializes objects. We then clear all
cached PAIs. The second call of GPAI on the BT thus runs full logic in a
concurrent setting.

Once all relevant objects (= maps and prototypes) no longer require
MT-serialization, reason b) is also addressed and the first pass can be
removed.

The new logic is implemented behind the runtime flag
--turbo-concurrent-get-property-access-info (default true), intended
to be removed in the future.

Bug: v8:7790
Change-Id: Idbdbfe091d7316529246a686bb6d71c2a0f06f8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817793
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74120}

Port: cc0d6a85

Bug: v8:11510
Change-Id: I4b2c0fa90e14609bb22de36b71e37eddc6f46af5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2845085
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#74119}

Bug: v8:11576
Change-Id: I3e15a3311eae44b0d70bcc8dc536eb777d92151f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835730
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74118}

promiseCapability can be undefined.

Bug: v8:11025
Bug: chromium:1201113
Change-Id: I9da8764820cee0db1f0c38ed2fff0e3afeb9a80e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844649Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74117}