This CL ports MarkingVerifier from blink.

The existing verifier checks only references on heap.
This new verifier checks references both on heap and on stack.

Bug: chromium:1056170
Change-Id: I083dcb0087125312cca34a2201015a9aecfe6ea4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300484
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68891}

This prevents v8 to send too many breakpoints and
thus exceed the maximum length for a message in
mojo.

Bug: chromium:1105172
Change-Id: I2af21f117d24c52d2f0df6294f15f091b84b1a75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300542Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68890}

We cannot allocate large arrays exceeding the size of
kMaxRegularHeapObjectSize in young space. Bailout of optimization in
such cases.

Bug: chromium:1105746
Change-Id: I4f7357c2dd7b3e70d747f9067660725ecf6ae768
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300481Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68889}

Rest arguments were using the builtin NewArgumentsElements to create its backing store. This does work when the rest elements are a suffix of the arguments in the stack, but this is not the case when V8_REVERSE_JSARGS is enabled.

This CL ports the builtin to Torque and fix the previous issues with V8_REVERSE_JSARGS.

Change-Id: I82db0dfd409d909336f34312f62c379ca5929e1e
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284988Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68888}

This CL adds global state management
methods into the App Class. Thus, make it
easier to control global state of the web app.

Bug: v8:10667, v8:10644

Change-Id: I9e37c3e851a3912ebc6c672eb4372f77d20a989c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300482
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68887}

Now that --concurrent-inlining is already using LocalHeaps and requires
a global safepoint, let's measure how long it takes to stop-the-world.

Bug: v8:10315
Change-Id: I90f451448199fd43b9991849f4343f77e4aa3813
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300544Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68886}

Bug: v8:7793
Change-Id: Ie573b3feef58329d524e51c942b67cf0525963ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300545
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68885}

This is an attempt to fix a build failure in MSVC14.26.28801.

Bug: v8:10691
Change-Id: Ic4b994b14e1ac70ab95f3da53bd7be382e38a4b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300540Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68884}

Otherwice, accesses in subsequent allocations may fail.

Bug: chromium:1101152
Change-Id: Ie8bd87e3ef68b532c8fa6ef85f757c930cbe35fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300485Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68883}

Bug: v8:7790, v8:10711, chromium:1105815, v8:10315
Change-Id: I94e7db3ce2247f6c59fa51a65f35591850bbd002
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300543
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68882}

Fixes build on some configurations with GCC/libstdc++.

Bug: v8:10708, v8:10315
Change-Id: I8f1c98e9143aa05b49b2a2d74f2024c093a5df29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299378
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68881}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7a85719..a96f200

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/49d9f03..0ea0cd5

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/35dec5f..ed9e5ac

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/58914a5..6412135

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ib59c4e7948961c356bc22e708ecb18213461ace6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2301068Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68880}

... which gets the zone from its ZoneAllocationPolicy instance.

This recovers memory regression caused by adding an AllocationPolicy
instance into TemplateHashMapImpl and therefore to VariableMap.

Bug: v8:10572
Change-Id: I7962b49e5f2669307e58b3ed7b1f29bab1c42cad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2298002Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68879}

In this test we both search and insert a transition in the main thread,
while the background thread searches.

Bug: v8:7790
Change-Id: Ic899f6c36c9bf9f7f5364ea30eb1c875b7ef6535
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2243211
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68878}

... this will avoid the need to pass AllocationPolicy to every method
that can allocate/deallocate and allows to make deallocation method
implementation stateful.

The latter will also allow implementing accounting of deallocated zone
memory.

Adding one more field is generally fine because usually these hashmap
objects are allocated on the stack or inside other rarely-allocated
long-lived objects.
The only exception is Scope class. The Scope objects are created very
often during parsing and each of them has a VariableMap field.
The Scope object size issue will be addressed in a follow-up CL.

Bug: v8:10572
Change-Id: I63fbd41246cf2e568c8ba80c213d3e9caffc2c87
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284992Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68877}

The cctests were wrong, since they access the first parameter using `Parameter(0)`. They should instead use `Parameter(1)`, since the index 0 is the receiver, and the receiver is set to be always the undefined object in `FunctionTester::Call`.

The reason it used to work is that the tests would set up an access to the stack with the wrong number of parameters, accessing only a stack suffix.

Change-Id: I02b7ee97c8759c7aecda0338863b7727762df1ba
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299364
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68876}

Make JSContextSpecialization constant-fold import.meta loads if the
meta object has already been created.

Most of this CL was contributed by Gus Caplan.

This is a verbatim copy of CL
https://chromium-review.googlesource.com/c/v8/v8/+/2170982
which could not be landed due to the wrong email address
being used.

TBR=verwaest@chromium.org
TBR=gsathya@chromium.org

Bug: v8:7044
Change-Id: Ief45f3082dc756265904ff500305d32717071e81
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299375Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68875}

The snapshot code assumes that the entire snapshot's length fits into
an int, which implies that it doesn't support individual objects that
are bigger than that. That's okay, because it isn't reachable from
user code, and embedders would notice at compile time when they run
into this limit. So we can just continue to skip the few regression
tests we have for huge TypedArrays in the stress_snapshot variant.

Change-Id: Ib37c0582763d549a3d5c5ccc3a78d200b176f3b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299373
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68874}

This is a reland of 273f4e42

Original change's description:
> [heap] Avoid ParkedMutexGuard during allocation
> 
> Since main thread allocation does not start incremental marking anymore
> while holding allocation_mutex_, background allocation does not need
> ParkedMutexGuard anymore to avoid deadlocks.
> 
> This also means background thread allocation isn't paused anymore to
> perform a GC, which already resulted in subtle bugs (e.g. in
> ExpandBackground with incremental marking). We also do not
> stop-the-world anymore while holding allocation_mutex_.
> 
> Bug: v8:10315
> Change-Id: Iadf00bc26434c765722b82a10497ab06151f15cc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289771
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68754}

Bug: v8:10315
Change-Id: If5aec78370685369ad0f1d7a76002d45f149ddfb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297468Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68873}

Change names of global functions from
globalXYZEvent to handleXYZ format to increase
readability.

Bug: v8:10667

Change-Id: Ie5e7b6b7ab1c535f5c6beb65361d0a78cac96e46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299362
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68872}

This change adds a has_error parameter on the stack
which allows the fast callback to report an error. In case
this parameter is set to non-zero, the generated code calls
the slow (default) callback, which can throw the exception.

Bug: chromium:1052746

Change-Id: Ib11f6b0bef37d5eb1d04cd6d0a3ef59028dcc448
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183929Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68871}

Change-Id: I96b8b6735b4a1d8bb42040ecd9e46c5e97675749
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2298141Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68870}

This CL establishes a naming convention
to increase readability of the code.

Bug: v8:10667, v8:10644

Change-Id: Id9fc9c558ba3957132b5a09aa975f9e8873c9dfd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297475
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68869}

Bug: v8:10680
Change-Id: I3a6055372b757fac4c5e28840536d1389e857437
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297381Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68868}

This CL attaches global functions of the panels
as instance variables of an app class.

Bug: v8:10667, v8:10644

Change-Id: Ib76730652f977ac81e3558ddb18165e938859512
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297476
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68867}

In addition to decoding them, we also have to evaluate the initializer
instructions when instantiating a module.
Drive-by fix: use "big-endian" encoding (prefix comes first) when
emitting initializers in the module builder.

Bug: v8:7748
Change-Id: Idfa0f5db298a8f6c6100fc09e1984e4a2e170e4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2298004
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68866}

mjsunit/regress/regress-896326.js failed on mips simulator, because mips
simulator has larger stack size and won't throw the expected RangeError
exception.

This CL set sim-stack-size to 100K in regress-896326 just like setting
the native machine's stack-size.

Change-Id: I51328b10a7b54addab2adb90401680c0581d7ee2
Bug: v8:10709
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299880
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68865}

This CL maps the colors being used in
the web app to variables to make it easier to
change color palette without having to track color
changes across files.

Bug: v8:10673

Change-Id: Icf1c53396b8a831367c4ed420931e6233d780a07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2298005
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68864}

When creating a new JSFunction (either through Factory::NewFunction or
the FastNewClosure builtin), install the cached Code object if one
exists. In the former, this happens explicitly; in the former implicitly
through %CompileLazy.

Drive-by: Clean up nci tracing methods.
Drive-by: Rename maybe_has_... to may_have_cached_code.

Bug: v8:8888
Change-Id: I98d87df10df496c45749b3fd76c072c36af45b68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2294662Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68863}

With CagedHeapLocalData, size of allocatable area in the caged heap has
reduced, but CL that introduced it didn't change the size passed to
BoundedPageAllocator.

Change-Id: I3720820589c88c3467af68cd7da1b305dc5a77b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297474Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68862}

Change-Id: Icccd7d8d0701ddbf9fb5088f5a47caa992f1b1e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2120296Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68861}

This is a follow-up fix for
  https://chromium-review.googlesource.com/c/v8/v8/+/2292230

In this CL fixes the case when the property cell is added to the
dictionary but the value is not actually stored which leaves
PropertyCell with the hole in the dictionary.

Now the logic for GlobalDictionary matches the logic for
NameDictionary - the property cell is added to the dictionary in
LookupIterator::ApplyTransitionToDataProperty().

Bug: chromium:1104711, chromium:1105383
Change-Id: I56da16d85d13288fbc41fd60dbce556fec5e7d18
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297472Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68860}

This CL fixes the Map Panel colors. The getColor
function of Edge class was always falling to the
default color unable to show correct colors in
the timeline panel.

Change-Id: Ide13b35703a656251222f512b2b9282f9f34cc04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297473Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#68859}

Instead of storing a weak pointer per isolate, store exactly one weak
pointer to the native module per engine.
This is a small preparation for switching to the jobs API.

R=ahaas@chromium.org

Bug: chromium:1101340
Change-Id: I5f6590421c890998aa95a0a3b34596f59f2f2690
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297471Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68858}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b8f14c0..7a85719

Rolling v8/third_party/aemu-linux-x64: sruBLlVcbmt9F1gAt88JIykKImWZUcWy2HLp9bT1IBYC..7UW9Qc56aQ1K23_T0oZ9qoVs9Hbuka0eN2NRy-z2UV0C

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/09e01d1..49d9f03

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6897807..35dec5f

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/d027d75..58914a5

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I2e501280a1420e18f8c0ed2f807244786b49209b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2298363Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68857}

Port d0e6ff15
https://crrev.com/c/2285149

Port 34871edd
https://crrev.com/c/2284212

Port dc82799d
https://crrev.com/c/2290623

Change-Id: I8cceface23368dafc6a029edaa7c6a125a0760ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2291306
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68856}

Change-Id: I946c9f0db1dcb91ab9414be2de8285444741ca3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2293499
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68855}

Make locales and options required
and no default for type in options.

Bug: v8:10623
Change-Id: I5df065a95e82ecb3b8b036d1b4738f296aa7243f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2291617Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68854}

Fix data race between concurrent threads allocating (accessing gc_state_
that way) and the main thread starting tear down.

Bug: v8:10315
Change-Id: Icc24811e43268512c8d7fdaf92ecd3fc7b3ecd57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297390Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68853}

Adds basic framework to pipeline.cc to enable a seperate fast register
allocator for the TurboProp mid-tier. As part of this, common logic as
well as a base class for RegisterAllocationData is moved to a seperate
register-allocation.h header file. The current register allocator's
RegisterAllocationData is renamed to TopTierRegisterAllocationData, and
the former name is the new base class held in PipelineData.

BUG=v8:9684

Change-Id: I28285b7d6112505bf90e88ea3cda66d03dfabc74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2295359
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68852}