This prepares a reland of https://crrev.com/c/869468.

Drive-by: Add a static_assert, also to document why
kV8MaxWasmMemoryPages was chosed to be slightly below 2GB.

R=titzer@chromium.org
CC=bradnelson@chromium.org

Bug: v8:6600
Change-Id: I6417bec191803c791fa5b218024ebcfde27e2aea
Reviewed-on: https://chromium-review.googlesource.com/873912Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50692}

- Add Map, WeakMap, Set, and WeakSet initial prototype maps to native context.
- Set and WeakSet constructors check whether prototype map differs from initial
  before choosing the fast path.

Bug: chromium:798026
Change-Id: I5f9cc2463f89e17f06a66b565c625fce133d01fb
Reviewed-on: https://chromium-review.googlesource.com/853698
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50691}

This reverts commit 7dbfec50.

Reason for revert: breaks libfuzzer build

Bug: chromium:803330

Original change's description:
> [api] Advance deprecation of v8::Script APIs
> 
> The calls in Chromium were removed in https://crrev.com/c/865160.
> 
> Bug: v8:7269, v8:7273, v8:7274
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: Id68649c479483679bf97bc66c14ce8dfa3f7d05c
> Reviewed-on: https://chromium-review.googlesource.com/868459
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50663}

TBR=adamk@chromium.org,yangguo@chromium.org

Change-Id: Iaf8ae89da9920c82d162ecb505502d5842d7c9b1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7269, v8:7273, v8:7274
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/873831Reviewed-by: Michael Hablich (vacation) <hablich@chromium.org>
Commit-Queue: Michael Hablich (vacation) <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50690}

On mips64, all arguments must be sign-extended, even unsigned types.

R=mstarzinger@chromium.org
CC=​sreten.kovacevic@mips.com, ivica.bogosavljevic@mips.com

Change-Id: If5229d34e1da684928f54bbcf389bb8e472d7d61
Reviewed-on: https://chromium-review.googlesource.com/868651
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50689}

This adds a test-preparser cctest corresponding to the regression test added in
https://chromium-review.googlesource.com/865900

BUG=chromium:801772

Change-Id: I33d74e242fd765b91b7c148b9a0af4960a7b05ea
Reviewed-on: https://chromium-review.googlesource.com/870311Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50688}

Rename csp to sp and remove support for the stack pointer abstraction and
switching stack pointers.

Bug: v8:6644
Change-Id: I616633aabc1cee9926249fe95ce6c37ed6544fe3
Reviewed-on: https://chromium-review.googlesource.com/870870Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#50687}

This reverts commit a7c91c77.

Reason for revert: changes a layout test
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/21031

Original change's description:
> [typedarray] Port ConstructByTypedArray to CSA.
> 
> This is needed to easily port the constructor dispatcher to CSA.
> 
> Bug: v8:7102
> Change-Id: I9672416495940ca12088a2980a9ecc61364aef9d
> Reviewed-on: https://chromium-review.googlesource.com/785630
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50671}

TBR=petermarshall@chromium.org,bmeurer@chromium.org,verwaest@chromium.org

Change-Id: I118a1cb0d873a1d2e159619e5f327f9f6f7974c4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7102
Reviewed-on: https://chromium-review.googlesource.com/873790Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50686}

Merge all of them to a single implementation, getting rid of all the
duplication.

R=marja@chromium.org

Change-Id: I5201e81ec64f3d7789df5e72bf58c85231cb348c
Reviewed-on: https://chromium-review.googlesource.com/868133
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50685}

This works around a bug in the libc++ implementation of bitset
(https://bugs.llvm.org/show_bug.cgi?id=35438) resulting in high
bits outside the bitset leaking through, breaking the ordering
invariant of PersistentMap::iterator. This did not surface so far
because the hash values used in escape analysis so far all only used
32 bits.

Bug: 
Change-Id: I18ce703020bf1fb3e1b412edaa899fa1afe0bba0
Reviewed-on: https://chromium-review.googlesource.com/793613
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50684}

Bug: chromium:774108,v8:6792
Change-Id: I4736b86ad5bd5e0777dc7a121023c4ed34d69fb0
Reviewed-on: https://chromium-review.googlesource.com/873170
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50683}

Bug: v8:7327
Change-Id: Ic33a0d86f055ac5ec3607d8e57d796428f4b9d20
Reviewed-on: https://chromium-review.googlesource.com/873378Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50682}

R=adamk@chromium.org

Bug: v8:7293
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I308fb8e87e6760664a33f3216af7a484ad1404c4
Reviewed-on: https://chromium-review.googlesource.com/864148Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50681}

This removes the Javascript version of Array.of in js/array.js and adds
a CodeStubAssembler version in src/builtins/builtins-array-gen.cc.

Mostly this change is for code-health reasons but it also gives
performance improvements for nearly all cases with the exception of
"transplanted" arrays. E.g.
function ArrayLike {}
ArrayLike.of = Array.of
ArrayLike.of(...) is now slower in the perf tests. Most of this change
can be attributed to using CallRuntime(kSetProperty,...) to set the
length. The JS version can do better due to inline caches trained on
the same datatype for 1000s of iterations, but this kind of workload is
unlikely.

Change-Id: I18e5b19b185257e9e0d553e1183b40ba4a5d3289
Reviewed-on: https://chromium-review.googlesource.com/863625
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50680}

This is a further step to separate the implementation of the JavaScript
API from the internals of the WASM implementation. Now, wasm-js.cc
only needs to interact with the WASM engine and is (almost) independent
of module-decoder.h and module-compiler.h.

Also, move SyncCompileAndInstantiate() into wasm-module-runner.cc.

Bug: v8:7316

R=clemensh@chromium.org, mstarzinger@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I7765af54ac16f53a5ff88c17a22c5d36bacaf926
Reviewed-on: https://chromium-review.googlesource.com/870871
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50679}

Record seperate virtual instance types for entries in FeedbackVectors:
- FEEDBACK_VECTOR_ENTRY_TYPE

 Bug: v8:7266

Change-Id: Ibea0615ecd23099e0107505e5d33cf194aade7c0
Reviewed-on: https://chromium-review.googlesource.com/866878
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50678}

TBR=machenbach@chromium.org

Bug: v8:6105
Change-Id: I56a08060c93fc86e752a7ef0156bbcca8a7ba261
Reviewed-on: https://chromium-review.googlesource.com/873132Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50677}

TBR=machenbach@chromium.org
NOTRY=true

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I0db40093d78433fa6304f5695969e5f0b259204e
Reviewed-on: https://chromium-review.googlesource.com/873633
Commit-Queue: Michael Hablich (vacation) <hablich@chromium.org>
Reviewed-by: Michael Hablich (vacation) <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50676}

With the current attempt, trying to iterate a const ZoneChunkList doesn't even
compile. See the bug for more info.

R=marja@chromium.org

Bug: v8:6473
Change-Id: I8de7e887398be7ba5da14dc540dd40b30df2c3fe
Reviewed-on: https://chromium-review.googlesource.com/868332Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50675}

Also fix a bogus test.

R=bmeurer@chromium.org

Bug: v8:5940
Change-Id: I6e201ce35f9021e12d1e4b6127d4accc1425cdb9
Reviewed-on: https://chromium-review.googlesource.com/870596
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50674}

No-try: true
Bug: v8:7266
Change-Id: I8b8ec94c1909e7404774afd576968cf843c043ff
Reviewed-on: https://chromium-review.googlesource.com/873033Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50673}

This reverts commit db129b65.

Reason for revert: blocks roll: https://chromium-review.googlesource.com/c/chromium/src/+/873150

Original change's description:
> [turbofan] Speculate on bounds checks for String#charAt and String#charCodeAt.
> 
> With the new builtin optimization guard we can just speculatively assume
> that the index passed to String#charAt and String#charCodeAt (in optimized
> code) is going to be within the valid range for the receiver. This is
> what Crankshaft used to do, and it avoids Smi checks on the result for
> String#charCodeAt, since it can no longer return NaN.
> 
> This gives rise to further optimizations of these builtins (i.e. to
> completely avoid the tagging of char codes), and by itself already
> improves the regression test originally reported from 650ms to
> 610ms.
> 
> Bug: v8:7127, v8:7326
> Change-Id: Ia25a555c5c1a48d229c094b1ecd2487eec81e390
> Reviewed-on: https://chromium-review.googlesource.com/872850
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50667}

TBR=yangguo@chromium.org,bmeurer@chromium.org

Change-Id: I6d393a0797cac2fdfd67487a26ac1b178bd52813
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7127, v8:7326
Reviewed-on: https://chromium-review.googlesource.com/873355Reviewed-by: Michael Hablich (vacation) <hablich@chromium.org>
Commit-Queue: Michael Hablich (vacation) <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50672}

This is needed to easily port the constructor dispatcher to CSA.

Bug: v8:7102
Change-Id: I9672416495940ca12088a2980a9ecc61364aef9d
Reviewed-on: https://chromium-review.googlesource.com/785630Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50671}

This fuzzer randomly generates calls to regexp builtins, runs each on
the slow and fast path, and verifies that their result is the same.

Change-Id: Ia91b0c8afcdaf64835a9bb7b9a470610fbb75fc8
Reviewed-on: https://chromium-review.googlesource.com/833922
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50670}

R=machenbach@chromium.org

Bug: v8:6105
Change-Id: Ie4a9ade13e280153c7ed55af03f9ff4c2d3cdd09
Reviewed-on: https://chromium-review.googlesource.com/873010
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50669}

Allow exporting the current selection as CSV.

No-try: true
Bug: v8:7266
Change-Id: Idd275e749506d2a195a132efa5ec08ebb21ca72f
Reviewed-on: https://chromium-review.googlesource.com/870781Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50668}

With the new builtin optimization guard we can just speculatively assume
that the index passed to String#charAt and String#charCodeAt (in optimized
code) is going to be within the valid range for the receiver. This is
what Crankshaft used to do, and it avoids Smi checks on the result for
String#charCodeAt, since it can no longer return NaN.

This gives rise to further optimizations of these builtins (i.e. to
completely avoid the tagging of char codes), and by itself already
improves the regression test originally reported from 650ms to
610ms.

Bug: v8:7127, v8:7326
Change-Id: Ia25a555c5c1a48d229c094b1ecd2487eec81e390
Reviewed-on: https://chromium-review.googlesource.com/872850Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50667}

This reverts commit 183bc643.

Reason for revert: https://logs.chromium.org/v/?s=chromium%2Fbb%2Fclient.v8%2FV8_Linux_-_debug%2F18780%2F%2B%2Frecipes%2Fsteps%2FCheck_-_extra%2F0%2Flogs%2Fmemory-size%2F0

Original change's description:
> [wasm] Fix page size constant + test limits on max pages.
> 
> BUG=chromium:801604
> R=​bbudge@chromium.org,titzer@chromium.org
> 
> Change-Id: I5fa57d5f8ea288d7aef7d466cbf11df46c4dcd1d
> Reviewed-on: https://chromium-review.googlesource.com/869468
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50665}

TBR=bradnelson@chromium.org,bbudge@chromium.org,titzer@chromium.org

Change-Id: I2b5a51f1a94e862f8ac4455d466e23d26c220202
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:801604
Reviewed-on: https://chromium-review.googlesource.com/872950Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50666}

BUG=chromium:801604
R=bbudge@chromium.org,titzer@chromium.org

Change-Id: I5fa57d5f8ea288d7aef7d466cbf11df46c4dcd1d
Reviewed-on: https://chromium-review.googlesource.com/869468Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50665}

This reverts commit e97daee2.

Bug: chromium:803046,chromium:774108,v8:6792
Change-Id: I15ee3c109b22fa9fe9658c93bd73cb4454310df5
Reviewed-on: https://chromium-review.googlesource.com/870837Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50664}

The calls in Chromium were removed in https://crrev.com/c/865160.

Bug: v8:7269, v8:7273, v8:7274
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Id68649c479483679bf97bc66c14ce8dfa3f7d05c
Reviewed-on: https://chromium-review.googlesource.com/868459Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50663}

This patch does not add any functionality, it just parses the private
fields. Adds a new harmony flag as well.


Bug: v8:5368
Change-Id: I71ce11868f458571eb57a4bc922223931ce5baa8
Reviewed-on: https://chromium-review.googlesource.com/862526Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50662}

We need to maintain TypeGuard nodes until the EffectControlLinearizer, because they can protect partial operations from floating above a check. In the linked bug, it was a DeadValue node that got scheduled too early.

In LoadElimination and EscapeAnalysis, the inserted TypeGuard nodes might depend on map checks on the effect chain. Thus TypeGuard has to be an effect chain node too.

Bug: chromium:800929
Change-Id: Icdcff96a2273d96b7f8cd6f85511ad62c1cb129a
Reviewed-on: https://chromium-review.googlesource.com/860405Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50661}

This is the first in a series of CLs that will separate the JS API
from the implementation of WebAssembly by bottlenecking interactions
through the WasmEngine. In the long run, the JS API and much of V8
should rely only on the WasmEngine interface, which will represent
the "public interface" for embedding WebAssembly.

Next: hide compilation-related methods behind WasmEngine.
Bug: v8:7316
Change-Id: I93404f0dc8a201ae99d30b4c1ca34606e3dddbca
Reviewed-on: https://chromium-review.googlesource.com/868590
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50660}

NOTRY=true

Bug: v8:6917
Change-Id: I08a09ba6f39fc3be7a11e520d2a59ced1354f892
Reviewed-on: https://chromium-review.googlesource.com/868291Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50659}

NOTRY=true
TBR=hpayer@chromium.org

Bug: v8:7012
Change-Id: If8517c27871af17a979d2766cc7f21b94035caa8
Reviewed-on: https://chromium-review.googlesource.com/870550Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50658}

Bug: v8:6917
Change-Id: I0b81ebfe289b459e30ad85a4a62ed244cbd20b65
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/870123Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#50657}

This will switch on various testing features in sanitizer builds and
for correctness fuzzer builds.

Currently we group enabling the slow-path runtime flag and allocation
timeout for atomic gc stress, but more features could be added in the
future.

This will enable gc fuzzer, clusterfuzz and correctness fuzzer to use
both slow-path and atomic gc stress in release sanitizer builds.

Bug: v8:6972
Change-Id: I5cade68241a8a0711f8a388be7e1543aab0035fa
Reviewed-on: https://chromium-review.googlesource.com/869932
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50656}

For memory tracing, output a 'T' for Turbofan code and an 'L' for
Liftoff code. To do this, the WasmCodeWrapper now has some dispatch
functions which work for both on-the-heap and off-the-heap code.
We can probably refactor more code by having this mechanism.

Since the output of --wasm-trace-memory differs now between Turbofan
and Liftoff, the message test is split in two.

R=titzer@chromium.org
CC=mstarzinger@chromium.org

Bug: v8:6600
Change-Id: Ic5fd18c631f5c8aaad19d639df75b18098895b5a
Reviewed-on: https://chromium-review.googlesource.com/868214Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50655}

This is a workaround for false positive race reported by TSAN.

Bug: v8:7315
Change-Id: I55712010dc5386a58b5ef7d48043e474f4b89bb9
Reviewed-on: https://chromium-review.googlesource.com/869672Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50654}

Bug: v8:6917
Change-Id: I54f908609fadd88bb23bf9fc566d1e2f3ff5e18e
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/870353
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50653}