Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/fb6dc3a..725734c

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I1f42691e880f0c9e038fb66ca7d2aa07a7cd6514
Reviewed-on: https://chromium-review.googlesource.com/1034217
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52873}

This is part of the effort to decrease the amount of undefined behavior.
that v8 relies on.

The main change here is to represent types with class Type rather than
with pointer Type*. To make the CL smaller, I used an operator overload
hack to separate the change from `->` to `.`. I am working on a CL that
will remove the operator and change all those arrows to dots.

Bug: v8:3770
Change-Id: I71a197cb739a1467937bc95c2a757fab0469aa22
Reviewed-on: https://chromium-review.googlesource.com/1032551
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52872}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/70ef8f2..fb6dc3a

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/ab7b6a7..b7d53a9

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/846cec5..a4814ec

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I911330b4529383347ca0b58660e78e6329a1751e
Reviewed-on: https://chromium-review.googlesource.com/1034075
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52871}

I16x8SConvertI32x4, I16x8UConvertI32x4,
I8x16SConvertI16x8, I8x16UConvertI16x8

Add packsswb/packssdw/packuswb/packusdw

Change-Id: Ibb661a20fa032d732fec20b3d48190f44d2d4bd4
Reviewed-on: https://chromium-review.googlesource.com/1027123Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#52870}

This finishes off the fixes and adds a DCHECK to make sure future tests
have page-sized memories. The one exception is for asm.js, because
asm.js does not have the same page size restriction.

Bug: v8:7704, v8:7570
Change-Id: I9f6d0f6c1744072fb1efa88abdfd2011938960df
Reviewed-on: https://chromium-review.googlesource.com/1033827Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52869}

Bug: v8:7704, v8:7570
Change-Id: I671f1355b9a95b0fcba56ac5fb3669b4563652dc
Reviewed-on: https://chromium-review.googlesource.com/1033543
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52868}

Bug: v8:7704, v8:7570
Change-Id: I3543e101ba41b88710e4f5942929e4e128ef2a78
Reviewed-on: https://chromium-review.googlesource.com/1033356Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52867}

Intl.PluralRules and Intl.NumberFormat.prototype.formatToParts
were shipped in 6.3 and 6.4, respectively.

Remove harmony_plural_rules and harmony_number_format_to_parts.

Bug: v8:5601, v8:5244
Test: mjsunit/intl-pluralrules-select
Test: mjsunit/intl-numberformat-formattoparts
Test: test262/intl402/PluralRules/unit/harmony/intl-numberformat-formattoparts
Test: test262/intl402/NumberFormat/prototype/formatToParts/*
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I1752622484bf9a0a8b9d810db54fc238f4caf3f3
Reviewed-on: https://chromium-review.googlesource.com/1032260
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52866}

* If the mutability of the global object doesn't match the module, then
  it should throw a LinkError.
* There was a missing `return` when importing a Number as a mutable
  global.
* All globals were being exported as immutable.
* Attempting to set the value of an immutable global should throw a
  TypeError.
* The length of the setter function should be 1.

Bug: v8:7625
Change-Id: I08d6a428506a18db15eecadf4cbcee89e0658924
Reviewed-on: https://chromium-review.googlesource.com/1031626Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52865}

Bug: v8:6600

Change-Id: I3aa174e28db83ca9e9f7a7b65c8007af8227908a
Reviewed-on: https://chromium-review.googlesource.com/1028764
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52864}

Bug: v8:7570
Change-Id: I90d9cb6c22c34017df2fd1613f3c94bb6a9afb52
Reviewed-on: https://chromium-review.googlesource.com/1033452Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52863}

Related: https://chromium-review.googlesource.com/c/chromium/src/+/1004440
Change-Id: I6040414e5d980c7d98a7a38e136cd8d2349a5c4c
Reviewed-on: https://chromium-review.googlesource.com/1017805
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52862}

Bug: v8:6600

Change-Id: Iec1804b89ed853833596a498bb1dfc15bb16c4ce
Reviewed-on: https://chromium-review.googlesource.com/1028763
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52861}

- Alignment of code sections is only relative to start of header. Code
  should be aligned in the buffer.
- Rewrites Reader/Writer classes to make global alignment easier.
- Rewrites the native serialization to simplify things in preparation
  for switch to streaming serialization APIs.

Bug: chromium:719007
Change-Id: I0397bc84a8d009b4fd7f5286bb5abc527bb0db95
Reviewed-on: https://chromium-review.googlesource.com/1027433
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52860}

When WebAssembly.instantiate or WebAssembly.instantiateStreaming is
called in JavaScript, internally we transfrom it into
WebAssembly.compile(buffer).then(WebAssembly.instantiate). However,
modifying the prototype of WebAssembly.Module can change the result of
WebAssembly.compile(buffer). With this CL we make sure that even if the
result of WebAssembly.compile is modified, there is still no type
confusion. In the long term we have to do a refactoring and remove
this internal transformation.

R=mstarzinger@chromium.org

Bug: chromium:837417
Change-Id: I376068b8b8b01b991ec450162da6a62ae7030c62
Reviewed-on: https://chromium-review.googlesource.com/1032392
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52859}

Bug: v8:6600

Change-Id: I2e18700344ce57c78c096fba1956d82f9e29ffa6
Reviewed-on: https://chromium-review.googlesource.com/1026469
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52858}

This reverts commit 9a7c4bfe.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> Revert "[elements] Improve Array.prototype.splice speed"
> 
> This reverts commit dcdabdc8.
> 
> Reason for revert: broke tsan.
> 
> Original change's description:
> > [elements] Improve Array.prototype.splice speed
> > 
> > By using memmove for SMI elements we get a roughly 3x speedup over the slower
> > iterative copying with write barriers.
> > 
> > Bug: chromium:835558
> > Change-Id: I73da07a1648a3495ff78212ffa1ed949d205a7d2
> > Reviewed-on: https://chromium-review.googlesource.com/1028236
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#52792}
> 
> TBR=cbruni@chromium.org,ishell@chromium.org
> 
> Change-Id: I77c46fe3d47d651de3c39df9fbf5f30c340188e2
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:835558
> Reviewed-on: https://chromium-review.googlesource.com/1028337
> Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52795}

TBR=kozyatinskiy@chromium.org,cbruni@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:835558
Change-Id: I57aedb3536b81c97cf4e7ab6d863aa1dc24c20b4
Reviewed-on: https://chromium-review.googlesource.com/1032743Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52857}

This reverts commit 6379e2a4.

Reason for revert:
https://logs.chromium.org/v/?s=chromium%2Fbb%2Fclient.v8%2FV8_Win64%2F23855%2F%2B%2Frecipes%2Fsteps%2FCheck%2F0%2Flogs%2Fmkgrokdump%2F0

Original change's description:
> [builtins] Patch self-references in constants table
> 
> During code generation, we generate self-references (i.e. references to
> the Code object currently being generated) as references to a temporary
> handle. When the final Code object has been allocated, the handle's
> location is fixed up and RelocInfo iteration fixes up all references
> embedded in the generated code.
> 
> This adds support for this mechanism to the builtins constants table
> builder. CodeObject() is now a new handle pointing to a dedicated
> self-reference marker in order to distinguish between self-references
> and references to undefined. In Factory::NewCode, we patch up
> the constants table.
> 
> Bug: v8:6666
> Change-Id: If74ed91bb1c3b8abb20ff2f0a87d1bcd9a1b0511
> Reviewed-on: https://chromium-review.googlesource.com/1018468
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52854}

TBR=yangguo@chromium.org,mlippautz@chromium.org,jgruber@chromium.org

Change-Id: I8cf8c4b43f51285ea913c6c8fdd339bd9ea645df
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Reviewed-on: https://chromium-review.googlesource.com/1033092Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52856}

Port 3f99a376

Original Commit Message:

    This is a reland of f5d30851

    Original change's description:
    > [builtins] Introduce further constant & external reference indirections
    >
    > This introduces further indirections for embedded constants and
    > external references for builtins generated by the macro-assembler.
    > The used mechanisms (LookupConstant and LookupExternalReference) are
    > identical to what we already use in CSA.
    >
    > Almost all builtins are now isolate-independent in both release and
    > debug modes. snapshot_blob.bin is roughly 670K smaller in embedded
    > builds vs. non-embedded builds, while libv8.so is roughly 280K larger.
    >
    > Bug: v8:6666
    > Change-Id: I7a6c2193ef5a763e6cf7543dd51597d6fff6c110
    > Reviewed-on: https://chromium-review.googlesource.com/1006581
    > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#52810}

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I037faebce37a866091dc35e04500790591292622
Reviewed-on: https://chromium-review.googlesource.com/1031397Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52855}

During code generation, we generate self-references (i.e. references to
the Code object currently being generated) as references to a temporary
handle. When the final Code object has been allocated, the handle's
location is fixed up and RelocInfo iteration fixes up all references
embedded in the generated code.

This adds support for this mechanism to the builtins constants table
builder. CodeObject() is now a new handle pointing to a dedicated
self-reference marker in order to distinguish between self-references
and references to undefined. In Factory::NewCode, we patch up
the constants table.

Bug: v8:6666
Change-Id: If74ed91bb1c3b8abb20ff2f0a87d1bcd9a1b0511
Reviewed-on: https://chromium-review.googlesource.com/1018468
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52854}

This removes the last reference from {NativeModule} that made it
specific to a concrete WebAssembly instance, by only referencing the
{WasmSharedModuleData} instead of a {WasmCompiledModule}. Note that
eventually we want to remove this reference completely to become even
independent of the underlying Isolate soon.

R=clemensh@chromium.org
BUG=v8:7424

Change-Id: I29b8cde8beadeef75c90e90fbff1830f2bf4e636
Reviewed-on: https://chromium-review.googlesource.com/1032433
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52853}

R=clemensh@chromium.org

Change-Id: Iade16b07a24dca8ac542e68becad734d977b673a
Reviewed-on: https://chromium-review.googlesource.com/1032778Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52852}

- Refine the type of 'hole'.
- Remove the mysterious 'receiver' definition.
- Remove the declaration of a non-existing Print function.

Bug: v8:7570
Change-Id: If093b456a9bc31c5673ada87f262c0cfcadf11ad
Reviewed-on: https://chromium-review.googlesource.com/1032737Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52851}

Bug: v8:7570
Change-Id: I2c6551fdd1a53323065f9c23e5bee793e9f561cf
Reviewed-on: https://chromium-review.googlesource.com/1032774Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#52850}

Linkage-related methods were declared in wasm-compiler.h and
implemented in wasm-linkage.cc. This required all users of e.g. wasm
call descriptors to include the whole wasm compiler header. Also, some
wasm linkage information is independent of turbofan and also used
outside of the compiler directory.

This CL splits off wasm-linkage.h (with minimal includes) and puts it
in src/wasm. This allows to use that information without including
compiler headers (will clean up several uses in follow-up CLs).

R=mstarzinger@chromium.org, titzer@chromium.org

Bug: v8:7570
Change-Id: Ifcae70b4ea7932cda30953b325c2b87c4176c598
Reviewed-on: https://chromium-review.googlesource.com/1013701Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52849}

Allocates almost all maps found in the start up snapshot into RO_SPACE.
There are 2 JSObject maps that are excluded as they contain a mutable cell.

Also updates VerifyReadOnlyPointers to check that RO_SPACE objects' maps are
also in RO_SPACE. Previously the invariant did not hold for Strings which still
had their maps in MAP_SPACE.

Also moves invalid_prototype_validity_cell to RO_SPACE.

    RO_SPACE  NEW_SPACE  OLD_SPACE  CODE_SPACE  MAP_SPACE  LO_SPACE
old    22024          0     229184       32928       8184         0
new    31488          0     229184       32928        176         0

Bug: v8:7464
Change-Id: I870d22cc5234ba60b3ef8a2ada590ee6ae426c9f
Reviewed-on: https://chromium-review.googlesource.com/1013494Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52848}

Bug: v8:6600
Change-Id: I49b3180603651609ce575e540169f995587f9d88
Reviewed-on: https://chromium-review.googlesource.com/1032615
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52847}

Bug: v8:7570
Change-Id: I74b482b670ce0e78dca012cbe8d9c2f65fdae5b9
Reviewed-on: https://chromium-review.googlesource.com/1030554
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52846}

Removes new_target member and getter since none of the Array builtins in
builtins-array-gen.* use it (since none of them are constructors).

delete new_target getter and member variable

Bug: v8:7570
Change-Id: Ia23af014750278d64447bb58171955d909fdb5a8
Reviewed-on: https://chromium-review.googlesource.com/1032556Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52845}

Bug: v8:6600
Change-Id: Ieefbd4530f068b41895a8eb608a480b563968d63
Reviewed-on: https://chromium-review.googlesource.com/1030331Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52844}

Temporary register at was rewritten. We use different register.

Change-Id: If3a162765ee29eb1d03d3f29345328cf79244e41
Reviewed-on: https://chromium-review.googlesource.com/1032616Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52843}

Trying to reduce use of our self-baked data structures.

Bug: v8:7570
Change-Id: I3c8598ece74b6434c8baa69810a384b5209dd107
Reviewed-on: https://chromium-review.googlesource.com/1032442Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52842}

BUG=v8:5402,v8:7570

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ia97efa31495b371805eb469be8395aaa19c7628d
Reviewed-on: https://chromium-review.googlesource.com/1032431Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52841}

Trying to reduce use of our self-baked data structures.

Bug: v8:7570
Change-Id: Ie4257911b388d320e4c5da5108cd763d3ab9299f
Reviewed-on: https://chromium-review.googlesource.com/1032555Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52840}

Whenever mjsunit.js changes, these tests might suddenly fail.

R=herhut@chromium.org

Bug: v8:7570
Change-Id: Ib43b03a3df92a4c5acabc193c63f46b29ea992b0
Reviewed-on: https://chromium-review.googlesource.com/1032440Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52839}

This adds support for f64.min and f64.max, implemented on ia32, x64,
mips and mips64.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: Ib4383df08692c76df5861fe71a96c4354fdf10c1
Reviewed-on: https://chromium-review.googlesource.com/1028235
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52838}

R=sigurds@chromium.org

Bug: v8:7570
Change-Id: I3f077940117467be98fbb3c2a30684af8eaaf801
Reviewed-on: https://chromium-review.googlesource.com/1032432
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52837}

Fix initial implementation of min/max f32 instructions.

Bug: v8:6600
Change-Id: Icb30515b692caef2c33bd85f468e83c17cdef2a3
Reviewed-on: https://chromium-review.googlesource.com/1030493Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52836}

R=ahaas@chromium.org

Bug: v8:7570
Change-Id: I5327d1b8e2f2bf4c1538f565442305a0e1f05b65
Reviewed-on: https://chromium-review.googlesource.com/1032550Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52835}

See referenced bugs for links.

NOTRY=true

Bug: v8:5193,v8:7702
Change-Id: I380479405f46cfc32d6cfa728fb86297f6d4f43c
Reviewed-on: https://chromium-review.googlesource.com/1032436Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52834}