Splits heap setup to enable a single setup method on read-only heap.
This simplifies shared read-only heap initialization code.

Bug: v8:7464
Change-Id: If4f61e1fbc4780e19dcda2b2d50050b2c204b0e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518179
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60224}

Change-Id: I9bd7c97dd0b36935bd1fb76cd2cbc83a1b28cdfb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1521223
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Auto-Submit: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#60223}

This enables things like simple DCHECKs in functions that do not have
access to isolate or heap.

Change-Id: I7962c28f0c6a4928ee880f1373501f29e45ae1f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1517886Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#60222}

R=yangguo@chromium.org

Bug: v8:8742
Change-Id: I307097021893617ed5178f1e967f9360a55cd929
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520710
Auto-Submit: Simon Zünd <szuend@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60221}

Bug: v8:8977
Change-Id: I3bf6606d9db2369f5d82c71c5f58f6cf0c34bc0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520712
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60220}

JSArrayIterator, PreparseData

Bug: v8:8952
Change-Id: I0a58402012f6fd5ded0eab92f7e28e3523342650
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1516474Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60219}

The JSONTraceWriter didn't write the "flow_in", "flow_out" and "bind_id"
fields, which are necessary to support TRACE_EVENT_WITH_FLOW and
friends. This just mirrors the logic from trace_event_impl.cc in Chrome.

Bug: v8:8991
Change-Id: I496db587fbb74d3c7205bbab4c23ec41c63fa715
Document: http://bit.ly/v8-tracing-signals
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1521108Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60218}

Bug: v8:8744
Change-Id: I2b4b7ace0dd7a0bcbb20ab0f41c30c25ce01cea2
R=machenbach@chromium.org,sergiyb@chromium.org

No-Try: true
Change-Id: I2b4b7ace0dd7a0bcbb20ab0f41c30c25ce01cea2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1521110
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60217}

Add a CheckSmi call to the value of the position argument to
String.prototype.startsWith(search, [position]).

Bug: v8:8400, chromium:939746
Change-Id: I7462bebe0d3fde605a4c27a34c0d9bb3f0cc1c20
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1514198
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60216}

[CSA] Eliminate write barriers for young generation large objects in CodeStubAssembler::ExtractToFixedArray.

Bug: v8:8945
Change-Id: Ib86ed35de107d5e658dbeaaca68d9a1cb8b0f309
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1515754
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60215}

I always have to look up which are the thread-safe ones. So add this
documentation in counters.h.

R=mstarzinger@chromium.org

Bug: v8:8834
Change-Id: I2cd28b6604585152b1ba3ecacbd597166f1b0e5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520716
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Auto-Submit: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60214}

This CL extracts the capturing for detailed and simple
stack traces into a configurable helper. Rather then introducing a
single flag for this helper, noting whether we capture simple or detailed
stack traces, each "difference" between the two can be turned on/off
separately, for easier, future refactorings.

R=jgruber@chromium.org

Bug: v8:8742
Change-Id: I0cf5e975438f05ff40f91d8a8f097059424e3d19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520326Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60213}

This updates the existing special casing of assignment operators by
gcmole to match for assignments of {HeapObject} instead of {HeapObject*}
variables. The former now uses the implicit C++ assignment operator call
instead of a primitive assignment binary operation.

Also removes the dead {handle_decl_name} field as a drive-by-fix.

R=mslekova@chromium.org
BUG=v8:8813

Change-Id: I0b48254e7ca1544bc064707a8ca1f204366ddbe4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1517879
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60212}

This CL just adds a parameter to addElementSegment and adjusts all
existing tests.

Note that addElementSegment contains some convenience code to construct
one initial table if it does not exist yet. I did not extend that code
to multiple tables. If you want to use multiple tables, you have to
create them first before calling addElementSegment.

R=clemensh@chromium.org

Bug: v8:7581
Change-Id: Ie131fd5dc19856703ab5cfb2fa8f7d576f70a18b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520709Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60211}

Bug: v8:8973
Change-Id: I64d6f574bc2e480b76ebefcf9ad27a96fbe60569
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520708
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60210}

R=sergiyb@chromium.org

Bug: v8:8744
Change-Id: Ie5c133010f47fb492079287e9cf4fbe49ae388ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520707
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60209}

As pointed out on https://crrev.com/c/1508675, the number of buckets of
{V8.WasmModuleCodeSizeMiB} should not change, thus change it back to
64. Also change the number of buckets for the two new counters for
symmetry.

R=isherman@chromium.org, mstarzinger@chromium.org

Bug: v8:8217
Change-Id: Ia7b10460be2c059d865381d3164a781668a7b0f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518173Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60208}

Rolling v8/test/wasm-js/data: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/a60f152..dae979a

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: I789d24a7626cb841636ead445fcfd5606240e0c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1519684Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60207}

This Cl adds a type to {WasmTableObject}, and extends
{WasmTableObject::Set} and {WasmTableObject::Get} to support anyref
tables. I did it in one CL so that I can write tests.

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I6c6d78f84715a7805f7bb881a63d3c1174f6a6ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1511332Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60206}

Enable cross-origin frame filtering by exposing this bit from
ScriptOriginOptions.

Bug: v8:8956
Change-Id: I109eec9db8b3d42d68d32abc5edd437b1c91a9b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1493294
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60205}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/8dcfd3a..96d6f98

Rolling v8/test/test262/harness: https://chromium.googlesource.com/external/github.com/test262-utils/test262-harness-py/+log/0f2acdd..9bd99c6

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/eb73833..967fadd

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/77e5d48..8b94108

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I4d6f917f187b8f0d4c436009946f63e56c8eb866
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1519681Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60204}

We need to ensure that the NativeModule stays alive while any
{BackgroundCompileScope} exists, because during that time we hold
shared ownership of the mutex in the {BackgroundCompileToken}. If the
{NativeModule} dies during that period, we would need to get exclusive
ownership of the mutex and deadlock.

This change requires holding a {std::weak_ptr<NativeModule>} in the
BackgroundCompileToken instead of a raw pointer, hence it can only be
initialized after the NativeModule was created. This is done via a
separate {InitCompilationState} method.

R=ahaas@chromium.org

Bug: v8:8979
Change-Id: Ia14bd272ea0bc47aec547024da6020608418c9d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518178
Auto-Submit: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60203}

We want to get rid of the atomicops library, hence switch all uses to
std::atomic.

R=mlippautz@chromium.org

Bug: v8:8926, v8:8834

Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
Change-Id: I7966d4ea98c5dd2ff712b1d84a6877f407f55ec7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518176Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60202}

R=jshin@chromium.org

Bug: chromium:938223
Change-Id: I0dca3f79f9466c559e1ad61b1f327428ee63732a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1513615
Auto-Submit: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60201}

R=binji@chromium.org,adamk@chromium.org
Bug: v8:7742

Change-Id: I13a317372fa06c706e2c648b92d2f2dd3c5a337b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1513152Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60200}

Change-Id: Ic4d58280e562a2f290f3b122004fc06a3188bd2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518555Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60199}

Tbr: mslekova@chromium.org
Change-Id: I721233d388081f702e460933d13e27cacbfcdf72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518183
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60198}

Bug: v8:8477
Change-Id: Id565bb8a4d420b715e3e89325786de699e30b22c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1517883Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60197}

The TryGetOwnProperty code supports only unique names that are not
array indices. Unfortunately, this is neither obvious from its type,
nor from its comment, nor from its code.

ProxiesCodeStubAssembler::CheckHasTrapResult violated the assumption
and was already fixed a few days ago. This CL fixes
CheckGetSetTrapResult and improves our code documentation in the
form of comments and assertions. Concretely:

- Add CodeStubAssembler::IsUniqueName and IsUniqueNameNoIndex
- Use IsUniqueNameNoIndex in CheckGetSetTrapResult to guard
  TryGetOwnProperty (bailout to runtime if not satisfied).
- Similarly, use IsUniqueNameNoIndex to simplify the previous fix in
  CheckHasTrapResult.
- Add a IsUniqueNameNoIndex CSA_ASSERT to TryGetOwnProperty and a few
  other places to avoid such bugs in the future.
- Add a IsUniqueName CSA_ASSERT to a few places where we apparently
  expect unique names (I don't know if those allow indices or not).
- Add a DCHECK to Name::IsUniqueName to ensure and document that this
  shortcut version is equivalent to HeapObject::IsUniqueName.

Bug: chromium:937618
Change-Id: Id4a18ab2a0e9c7591b087dd0c9fe018aa9b9ef3a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1514732
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60196}

In particular, remove {toUint8Array} method and make {toBuffer} return
a {Uint8Array} view to the buffer like before
https://crrev.com/c/1508352. Also, the returned view does not need to be
another copy of the bytes, it can really just be a view.

As a follow-up, this requires the test-only DeserializeWasmModule
runtime method to receive the wire bytes as Uint8Array, and also
requires the {IsWasmCompileAllowed} callback to handle
{ArrayBufferView} (like chromium's version already does).

R=ahaas@chromium.org

Change-Id: I87296cdbac14b74e7c8b38a372aa3df572ca6ad6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518172
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60195}

R=jgruber@chromium.org

Bug: v8:8834
Change-Id: I36b3fc2e29111054caf395b6875f238bf43ab3de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518177
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60194}

This will allow us to avoid packaging cctest into official archives, while still
keeeping them around for refbuilds. As a result, official archives will become a
lot smaller.

Corresponding recipe change: https://crrev.com/c/1517881

R=machenbach@chromium.org, tmrts@chromium.org

Bug: v8:8969
Change-Id: Icf67d2f6dd5dc4d4a4f32f9b5c5ef21758410546
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1517880
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60193}

This removes a redundant "mov <reg>, #0" by spilling the zero register
directly.

Change-Id: I608f5200ee25e176f6d3279aec07c581d9f7d769
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1517872Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#60192}

The regexp interpreter holds several unhandlified references to heap
objects, and is thus within a DisallowHeapAllocation scope. But there
are two situations in which we can and do allocate safely:

1. When creating & throwing a stack overflow exception. The interpreter
   aborts afterwards, and thus possible-moved objects are never used.
2. When handling interrupts. We manually relocate unhandlified references
   after interrupts have run.

This CL explicitly allows allocations on stack overflows.

Isolate::StackOverflow allocates heap objects.

Bug: chromium:940722, v8:8724
Change-Id: I74ef6f0dd7a30bd55f49a7bc0f2f6ac82adbeda8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518174Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60191}

Enabled Wasm interpreter as first-class tier. Depending on the flag
{--wasm-interpret-all} the interpreter is the default and only tier
used to run Wasm modules.

Change-Id: I9ffa333f7138437e646dee2113f06c1676bac331
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1516292
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60190}

We want to allocate feedback vectors lazily in lite mode. To do that,
we should create closures with the correct feedback cell. This cl
allocates feedback cell arrays to hold these feedback cells in lite mode.
This cl also modifies the compile lazy to builtin to expect these arrays
in the feedback cell.

Drive-by fix: InterpreterEntryTrampoline no longer has argument count in
a register. So updated comments and removed unnecessary push/pop of this
register.

Bug: v8:8394
Change-Id: I10d8ca67cebce61a284f0c80b200e1f0c24577a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1511274Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60189}

This function is not used (anymore) but needs to be defined, so put an
UNREACHBLE inside.

Bug: v8:7790
Change-Id: I5a8df2cbc236f60ee95ccc9d91c288d8d9c19060
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1515792Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60188}

... similar to how we do this in native irregexp code, i.e. handle
interrupts on each backtrack. Unhandlified references into the code
ByteArray and the subject String object are updated after a potential
GC.

Since interrupts may change the subject string's representation, the
interpreter is now called in a loop to handle retries.

Bug: v8:8724
Change-Id: Ic34de8d69ccc56d4656b8ed080c2c168c212ebfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1511477
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60187}

Extensions are now always passed via unique_ptr and are owned by V8.
This CL removes the deprecated API where the embedder would own the
Extension, but has no mechanism for deleting it.

R=ulan@chromium.org

Bug: v8:8725
Change-Id: Icb83660fad9d04c66f8db2265091ebabcbb197c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1514493Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60186}

The counter is dead since August 2017 (https://crrev.com/c/633703).
The corresponding chromium histogram is removed in
https://crrev.com/c/1514812.

R=titzer@chromium.org

Bug: v8:8975
Change-Id: I6fa457018deb25cfd36d7de660fcfe996902c811
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1514737Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60185}