NOTRY=true
TBR=tmrts@chromium.org

Change-Id: I2529fde85060571d0fd73e81e384948ef4cbd880
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678662Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62398}

Just the low-hanging fruit. There is more to do.

Bug: v8:2487
Change-Id: Ia9afa32797960f6c4c7c4fa0f39c70efc63663e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669698Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62397}

Bug: chromium:967927
Change-Id: Id84f8ebd1ecbad1b3d1fc41ec5d35a497e1ce506
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649174
Commit-Queue: Harley Li <hhli@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62396}

This reverts commit 8de427fa.

Reason for revert: Seems to be causing GC memory issues:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20nosnap%20-%20debug/24545


But, also see: https://chromium.googlesource.com/v8/v8.git/+/7440edae1da2b78a37e6fe3a558e249dc33444aa

Original change's description:
> [debugger] Expose reference to the function in debug-evaluate
> 
> R=​verwaest@chromium.org
> 
> Bug: chromium:878723
> Change-Id: Ic07f75f15230018b6d19cd1ee21f4be6dcad6360
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667408
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62385}

TBR=yangguo@chromium.org,jgruber@chromium.org,verwaest@chromium.org

Change-Id: I099f7b2f40e8afdddc50201a8929950b2f4ac1e2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:878723
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678401Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62395}

[objects] Migrate kHoleNanInt64 unboxed doubles to uninitialized values during boilerplate serialization

Boilerplate values may possess an unboxed double field filled with the kHoleNan64Int sentinel value, which indicates that the field is uninitialized. When a boilerplate value migrates away from the unboxed double representation to a tagged one, we should replace the sentinel value by the proper uninitialized oddball value.

This fixes an issue with JSCreateLowering::AllocateFastLiteral not detecting const stores of uninitialized values properly.

R=bmeurer@chromium.org, jarin@chromium.org

Bug: chromium:976598
Change-Id: I6bb216c0618a3105e6c8cfc04b1900d2f83a52ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1674034Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#62394}

According to spec https://tc39.es/ecma262/#sec-object.preventextensions, the commit 8e0ef9b9 is missing the last step when object is proxy, it needs to return the object.
var proxy = new Proxy({}, {});
var object = Object.preventExtensions(proxy);
proxy === object; // should be true

Also, add mjsunit test.

Bug: v8:6664
Change-Id: Ic3688519539f8903ee0bc7e885905a86d195a4db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1668443
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62393}

Bug: chromium:977893
Change-Id: Ibd4be9b9ce13bcb8aca4b6ac6d7a1c56a01e39d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676606Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#62392}

Bug: v8:9353
Change-Id: I740b2987da1719af6c3d4a6471e7f047801cfd5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678368Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62391}

This makes the code easier to read, and will also be helpful for the
extension to multiple indirect function tables.

R=clemensh@chromium.org

Bug: v8:9396
Change-Id: Idba143611e13f6b6cfc0e9d6c6f380ee3566db80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678476
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62390}

... when building inspector objects.

This is useful in Chromium, when recording the initiator information
for navigations.

See https://chromium-review.googlesource.com/c/chromium/src/+/1674885

Change-Id: Ib9ddcaf05586ca1f48a31921a20ab11a703ec7b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1677381Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62389}

Also show constant for ArchNops that encode assigning from a
constant.

Change-Id: I84590005dda62ebf445aada57f826f5ffcd5a802
Bug: v8:7327
Notry: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1672943
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62388}

For float to int conversions and vice versa the MacroAssembler on x64
was using a mix of AVX and non-AVX instructions.
This CL fixes that to consistently use AVX if available.

R=jkummerow@chromium.org

Change-Id: I3aecda9b99881254b24949ced5bed870fdc2a754
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678361Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62387}

R=sigurds@chromium.org

Change-Id: Icd6e66b9bb23ca0dbf9fc5fe5c737a0bc3056a89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678359
Auto-Submit: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62386}

R=verwaest@chromium.org

Bug: chromium:878723
Change-Id: Ic07f75f15230018b6d19cd1ee21f4be6dcad6360
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667408Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62385}

Offset adjustment on misaligned loads causes offset to be
overflow. This fixes it by using ldx if the new offset overflows.

Change-Id: Ib0fd339c127b70d5cbc9096b54480eb4355e753c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678396
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Auto-Submit: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62384}

R=sigurds@chromium.org

Change-Id: Id22a44fa15827d5c076496d872fe3be7da360b5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678356
Auto-Submit: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62383}

We only need to save the native context scope info object to
properly brokerize promise call reductions, rather than
adding the field to each ContextRef.

Bug: v8:7790
Change-Id: Id13dc8505972123cf77a50573c816c9a913686e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678416Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62382}

This is a reland of 5ff38bae

Original change's description:
> [TurboFan] Fast path for JSAdd with BigInt feedback
> 
> This CL introduces the necessary infrastructure to generate speculative
> BigInt operations in case of BigInt feedback. In particular, the JSAdd
> operator is lowered to a speculative call to the  BigIntAdd builtin,
> with a deopt bailout in case of exceptions or violated assumptions.
> 
> Bug: v8:9213
> Change-Id: I05796336eef9a4389fc31d59cad2d69f75512647
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657916
> Commit-Queue: Nico Hartmann <nicohartmann@google.com>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62362}

Bug: v8:9213
Change-Id: Ic0caf7aab2103b8f5e22a504427e8604cc894d75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1677209Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@google.com>
Cr-Commit-Position: refs/heads/master@{#62381}

... instead of [Maybe]ObjectSlot.

Bug: v8:9353
Change-Id: I9747da70895e459882a83d06cc20a13b8519e500
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678196Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62380}

Bug: v8:9355
Change-Id: I42a683f9480435499e603083e844a47150ae57c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676244Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62379}

When concurrent marking is on then normal stores to tagged fields must
be relaxed stores.

Bug: v8:9396
Change-Id: Id1189a6c7df5ae8e9e5dc4dad653d35bdd109c5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1677207Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62378}

Deprecated maps might not be updated before being passed to
PrepareForDataProperty. If the target map is a dictionary map,
then adding the data property can fail.

As a drive-by, remove the dead ForTransitionHandler code, which
was another (potentially unsafe) caller of PrepareForDataProperty

Bug: chromium:977012
Change-Id: I894bbc9bca2001555474a3570eb03fe6b0f69ddd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1674029
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62377}

There's no reason to use the API RegExp type instead of the internal
JSRegExp type. In fact, the parsed flags end up in
Runtime_CreateRegExpLiteral, which assumes them to be of type
JSRegExp::Flags.

Drive-by: Additional asserts and helper functions in JSRegExp.

Bug: v8:9359
Change-Id: I5c12aba7d4e39a4891fb23d8b47c55fc480a28d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667004Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62376}

... for defining isolate-full getters.

Bug: v8:9353
Change-Id: I91aa11bfe41ab61b2fa72c21018fc38753a846bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676286Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62375}

It shipped in Chrome 71.

Bug: v8:5537
Change-Id: Ia78c58dc0af941ec87c05c933419f7e93d2b26f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675951
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62374}

... instead of ISOLATELESS_GETTER for declaring and defining getters
and predicates that have to deal with decompression of tagged fields.

The new macro eases introduction of isolate-full getters.

Bug: v8:9353
Change-Id: Ic63baea819a9320c5677f5bd7dda123d7334d80f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676285
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62373}

... in order to improve quality of C++ assembly.

This CL also switches C++ code to use branchful decompression.

Bug: v8:9353
Change-Id: Id6a5cc5db2ad729b4394cd541a7ec8035c0d4571
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1677204
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62372}

Change-Id: I8e6f10d6a5cba981134b44fda1a8ae3a4ea0fc97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675959
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62371}

In TurboFan, context specialization is an optimization that tries to
either replace the load of a value from the context with a constant,
or if that can't be achieved, at least reduce the hops up the
context chain by starting a walk to the required depth from the
first constant context that it can reach.

Currently, this optimization is performed by looking into the
heap during a reducer pass. With fully concurrent TurboFan, we
need to instead gather information about contexts we may want
to perform this optimization on during serialization.

This CL adds functionality to the serializer to recognize and
model operations that affect the context register. We add to the
hinting structure already used by the serializer. There is
a new type of hint: a VirtualContext. This is a tuple consisting
of a handle to a Context, and a distance field that indicates how
far away in a to-be-realized chain this VirtualContext sits from
the context in the handle. For example:

bytecode stream:
...
CreateBlockContext
...

After a block context is created, the accumulator now contains
a VirtualContext Hint with a distance of 1 from any context hints
that we are keeping track of in the current context register.

More details in the design doc here:
https://docs.google.com/document/d/1Y0LKKCEenLWyAZTetoAIpKTZRCxaNdkYV8X1GaCax2A/edit?usp=sharing

Change-Id: I63732ebd106cc138fb1e9789d0676ece63e15d27
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1605941
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62370}

This makes sure that BUILDING_V8_SHARED and USING_V8_SHARED are not
both set at once.

Change-Id: Iba3a4fac37518b6ec3658da4575453a7967ece0f
Bug: v8:8855
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627978Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62369}

Large regexp results may exceed kMaxRegularHeapObjectSize and must
thus be allocated in large object space.

Drive-by: Rename '%InNewSpace' to '%InYoungGeneration'.

Bug: chromium:976627
Change-Id: I38b5aecb95a95cf2fdbb24d19550cec34361a09d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1674027Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62368}

We currently only sample synchronous compilation via
"V8.WasmCompileModuleMicroSeconds.wasm". This adds a similar counter
for asynchronous and streaming compilation. Both use the
{AsyncCompileJob}, which now records the start time of compilation and
records a sample when baseline compilation finished.
The sample will only be taken if a high-resolution clock is available.

R=ahaas@chromium.org
CC=jwd@chromium.org

Bug: chromium:978425
Change-Id: I4b083a8ebba685a1cc8fa87bfe30e9a0943e3394
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675963Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62367}

Samples for the wire bytes size histogram were only recorded in
synchronous and asynchronous (non-streaming) compilation. This CL adds
another sample for streaming compilation.

R=ahaas@chromium.org

Change-Id: I11e2606796a83d6bebb35bd1d554aea43907bfba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676284Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62366}

The call was renamed in	Fuchsia, the transitional *_new	variant	is
going to be removed soon.

Bug: chromium:977753
Change-Id: I3734cc36a15635dce4dc00d07917879761dec0f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676610
Commit-Queue: Fabrice de Gans-Riberi <fdegans@chromium.org>
Commit-Queue: Wez <wez@chromium.org>
Auto-Submit: Fabrice de Gans-Riberi <fdegans@chromium.org>
Reviewed-by: Wez <wez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62365}

This reverts commit 5ff38bae.

Reason for revert: flaky test that is not normally flaky failed.

See: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20nosnap%20-%20debug/24531

Original change's description:
> [TurboFan] Fast path for JSAdd with BigInt feedback
> 
> This CL introduces the necessary infrastructure to generate speculative
> BigInt operations in case of BigInt feedback. In particular, the JSAdd
> operator is lowered to a speculative call to the  BigIntAdd builtin,
> with a deopt bailout in case of exceptions or violated assumptions.
> 
> Bug: v8:9213
> Change-Id: I05796336eef9a4389fc31d59cad2d69f75512647
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657916
> Commit-Queue: Nico Hartmann <nicohartmann@google.com>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62362}

TBR=jarin@chromium.org,neis@chromium.org,sigurds@chromium.org,nicohartmann@google.com

Change-Id: I5ae63a0183283894b6d1130792ab37a95b014550
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9213
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676607Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62364}

Bug: v8:6664
Change-Id: If5a8a85a7537fa429fb58d1e0654ffe5f6a5897f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669788
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62363}

This CL introduces the necessary infrastructure to generate speculative
BigInt operations in case of BigInt feedback. In particular, the JSAdd
operator is lowered to a speculative call to the  BigIntAdd builtin,
with a deopt bailout in case of exceptions or violated assumptions.

Bug: v8:9213
Change-Id: I05796336eef9a4389fc31d59cad2d69f75512647
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657916
Commit-Queue: Nico Hartmann <nicohartmann@google.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62362}

In the context of the reference types proposal, the imaginary sub type
of all types was called "bot". With this CL we use this name now also
in V8.

R=clemensh@chromium.org

Bug: v8:9396
Change-Id: I65a2a177ae2af97e66549e7a5b1457595b04a1d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675950
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62361}

Change-Id: I386882ba9a95a7eeaa7995423a9d981850680d95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675957Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62360}

Currently, probabilities for extra flags are calculated in the correctness
fuzzer harness, which makes the RNG fragile when bisecting backwards, when
the script's config changes during bisection.

This adds the possibility to pass extra flags on command line to the
script. After a grace period, we will migrate the flag calculation to
clusterfuzz.

NOTRY=true

Bug: chromium:813833
Change-Id: I515181847474515089b847f8aaffc7c6560d9390
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675945Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62359}