In native context independent code we cannot embed the (native context
dependent) feedback vector as a constant. Instead, we will load it
from the JSFunction once and pass it to all users. This CL makes this
change for all unary operators. All other {binary,compare} operators
will need similar work in the future.

Bug: v8:8888
Change-Id: I4d49a6e0effc84dcdf3599814e5c2708b16bcc44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2246576Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68448}

This check skips inserting a breakpoint into the BreakPointInfo if
it has already been inserted before.

Change-Id: Ic773fe1d6b2351bf6069fa0ff002737bd0b03293
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253851Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68447}

Change-Id: I70fa23a2491186d2bf94b26a292163efa1c23d61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2255503Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68446}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3591130..2dc7c7a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4ac015d..95c1f42

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2410c84..35c6274

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/eaf99a4..02daed1

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ia2219c9b1aeaff06fb06c29e2d08089d22c63ed4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2255501Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68445}

This implements I32x4DotI16x8S for ia32.

Also fixes instruction-selector for SIMD ops, they should all set operand1 to be a register, since we do not have memory alignment yet.

Bug: v8:10583
Change-Id: Id273816efd5eea128580f3f7bde533a8e1b2435d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2231031
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68444}

Bug: v8:7748
Change-Id: I9af885e4c33541a8e065082ae7f07804bd11807a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252190
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68443}

Refer to "Advanced SIMD two registers misc", ARM DDI 0487F.b F4-4228.

Also moved the method down to the section with all the NEON
instructions, matching where the declaration in assembler-arm.h is.

Bug: v8:10553
Change-Id: I450edbfc3eafead4aad419299c93e43bd9d83133
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252764Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68442}

Bug: v8:10445
Change-Id: I45b142bd1f4330dc07d06f89dc9daf7db127aaaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253958Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68441}

Replace by "consistency check", or "validity check", or more specific
wording as appropriate.

R=ecmziegler@chromium.org

Bug: v8:10619
Change-Id: Ifd7852d8f703d5b784d53671b82d65db15722ede
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253855Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68440}

Bug: chromium:1091698
Change-Id: Ida82d262f409c54e59640bcaa026879d18ff178d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252184
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68439}

Port c6642b51

Original Commit Message:

    We rely on Liftoff for debugging, hence enable it everywhere by default.
    This follows a chromium finch experiment and a CL to enable it
    everywhere in chrome: https://crrev.com/c/2252100

R=clemensb@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I1a8e7a4acb9a5ce5a6d0ba96b105ba32e53f1b69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253464Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68438}

Formerly, we zapped a transition array when we replaced it with a
larger one, but this is no longer necessary. Leaving those arrays in
peace makes life easier for concurrent (racy) access from a background
compilation thread.

Design doc with more info about racy access to transition arrays
between the main JavaScript thread and a background compilation thread
here:
https://docs.google.com/document/d/1ax2qyENdr50Qu9yur1qNu6_zRK0m6K2l7BLM_QDBFJM/edit?usp=sharing

Change-Id: I4c2757945266d43d82ec157e0ff2b9208a8e4c63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253840Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68437}

Avoid possible use-after-free.

Fixed: v8:10210
Change-Id: Id8bdf70804448b5b793d9d593374f4b588fe3e87
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253841
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68436}

Change-Id: I37e241d9c62f1a7fed438ee8717f02f5b4f51bea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253846
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68435}

This CL migrates the bots v8_mac64_gc_stress_dbg
and v8_mac64_asan_rel to the new format.

Bug: v8:10445
Change-Id: I7520985499c91c6571ba93e1515223f57f0d38ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253839Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68434}

Until now the breakpointIdToDebuggerBreakpointIds was cleared on page
reload. It keeps a map from breakpointIds to debuggerBreakpointIds,
with the latter being necessary for removing breakpoints.

If a breakpoint is set and we trigger a page reload, the
information about that breakpoint will be removed from the map,
even if it still exists. If we later want to remove the breakpoint
we look into the map, but the meta data is no longer existing.

Thus, reloading the page again will lead to hitting the breakpoint,
even if we removed it in the front-end.

This change keeps the map alive on page reset, so that we still
keep track of set breakpoints after a page reload.

Bug: chromium:1073071
Change-Id: I82192777bac7afc406245a5a1cff0620e8174499
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253842Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68433}

evaluate() bypassed CSP for unsafe-eval by default. This is a useful
option for debugging clients, but is not always what we want.

e.g. in the devtools console we want to match the page's CSP settings
to make debugging CSP issues on the page easier.

Add a toggle that keeps the current behavior by default.

Bug: chromium:1084558
Change-Id: Ia01142d5be00f8ef5f65e5eeba17549efc6f9120
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250245
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68432}

We rely on Liftoff for debugging, hence enable it everywhere by default.
This follows a chromium finch experiment and a CL to enable it
everywhere in chrome: https://crrev.com/c/2252100

R=ecmziegler@chromium.org

Bug: chromium:1040030
Change-Id: I3abbf915515883e6eb1f37501466290def57862d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252196Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68431}

Bug: v8:10009
Change-Id: Iccc42a9b5f9f7340851542185473ac49683c838c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253843Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68430}

Make sure that the workers do not start running before the main thread
told them so by setting the memory to the first element in the sequence.
Otherwise it can happen that the main thread resets the memory after the
workers already started doing their updates, which results in a hang
(see linked bug).

R=marja@chromium.org

Bug: v8:10625
Change-Id: I959018279e0049900d44457b72146bc37a12bcb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252191
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68429}

Bug: v8:7748
Change-Id: I58e8216e3d51aa9da3e6a819cdf2614b4509e1a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250249
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68428}

Bug: v8:10473
Change-Id: Ic53130ca5103ba219329f7b204b218bc021f07f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252178Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68427}

This is a reland of e0c1a349

The issue was passing SentinelPointer (== +1) through T*.

The fix is disabling cfi unrelated cast diagnostic for the bottlenecks
(Get()). This means that nullptr is treated the same as
kSentinelPointer.

The alternative would be a DCHECK that Get() does not return
kSentinelPointer and adjusting all Member and Persistent logic that
uses Get() to work on void*. This is quite intrusive as it involves
Swap(), heterogeneous assignments, comparisons, etc.

Original change's description:
> cppgc: Properly clear (Weak)Peristent and WeakMember pointers
>
> The CL addresses two issues with (Weak)Persistent and WeakMember:
> 1. (Weak)Persistent pointers are cleared on heap teardown. Before this
>    CL the pointers would contain stale values which could lead to UAF.
> 2. WeakPersistent and WeakMember are cleared using a combination of
>    internal clearing methods and mutable fields which avoids the use
>    of const_cast<>.
>
> Bug: chromium:1056170
> Change-Id: Ibf2b0f0856771b4f6906608cde13a6d43ebf81f3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248190
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68394}

Bug: chromium:1056170
Change-Id: I3d74b43464c2973df1956f51b1419d755dd9f519
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250240Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68426}

This CL introduces one-letter shorthands to HeapTypes, and fixes
signatures to be in sync with the ValueType and HeapType shorthands.

Bug: v8:7748
Change-Id: I4cc8e26d6523074bc36bf2d29289e63a23e80ddc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2249672
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68425}

Increase TypedArray.kMaxLength by 1.

Bug: chromium:1095721
Change-Id: Ic3668ff4e71cfd1289eda495333c4aae62c44795
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2249668Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68424}

Bug: v8:7748
Change-Id: I6087c02aab93ba44b8029f3d1a0c99fd6a4da6f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250248
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68423}

Bug: v8:10599
Change-Id: I1248d365576c0bc8c01d8ce07f0c49654fabfc52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2251173
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68422}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/78f36d4..3591130

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/3200e0f..1ed9957

Rolling v8/buildtools/linux64: git_revision:fbe7aec770944d17c9f3006f6cbb5c19e8cd43ea..git_revision:7d7e8deea36d126397bda2cf924682504271f0e1

Rolling v8/third_party/aemu-linux-x64: T98d0T9VlsHV98PPahwzBa8kF94z5dghLKOTUDCTmwYC..UoYLOT0X6577j70eB9nPqYQs9Z3Nh5lA4I-pRtTchO0C

Rolling v8/third_party/android_sdk/public: CR25ixsRhwuRnhdgDpGFyl9S0C_0HO9SUgFrwX46zq8C..uM0XtAW9BHh8phcbhBDA9GfzP3bku2SP7AiMahhimnoC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/fbbd9ca..4ac015d

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/3eb899a..2410c84

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/9e7dae8..79326ef

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/0d67b22..42b285f

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I3024219a33b862fef5e7393a3e18c88f46e29dc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253105Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#68421}

This was causing issues with strict mode when combined with fuzzers. See
https://crrev.com/c/2173952/7/test/mjsunit/wasm/wasm-module-builder.js#471

Change-Id: I164b24c35d7ba7c53a550dc3649eb7268dfb30e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252540Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68420}

Prototype f32x4.ceil on ARM for both ARM v7 and ARM v8. ARM v8 has
support for vrintp, and for ARM v7 we fallback to runtime.

Since ARM v8 uses vrintp, which is the same instruction used for F32
Ceil (scalar), wasm-compiler reuses the Float32Round check, rather than
creating new F32x4Round optional operators.

Implementation for vrintp (Advanced SIMD version that takes Q
registers), assembler, disassembler support. Incomplete for now, but
more will be added as we add other rounding modes.

Bug: v8:10553
Change-Id: I4563608b9501f6f57c3a8325b17de89da7058a43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248779Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68419}

Similar to chromium side change: https://crrev.com/c/1961070.
When checkout_clang_tidy is set, we will check out clang-tidy via
clang/scripts/update.py.

The goal is to be able to run clang-tidy using Tricium.

Bug: chromium:1087565,v8:10488
Change-Id: I14ebaaca33ca20d59d9cc5e537826829608a1e6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2242257Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68418}

Bug: v8:10180
Change-Id: Ic341e0de315b7d7b33dbad265c8fda9145a669da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2243760Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68417}

Extend gm.py to support long flags (starting with --), which are treated
as test runner flags, and passed unchanged. These flags must be as
single word, '--progress=verbose' instead of '--progress verbose', as gm
only does simple one-at-a-time args parsing.

Change-Id: Icfa161ff231715d0b7eb3ba259fca35a65c68964
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250875
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68416}

When preparsing and detecting a sloppy block function redefinition then
don't mark the variable as assigned to make it consistent with the eager
parser.

Bug: chromium:1053364
Change-Id: Iec7c24db80014bfe73ee41a4f3bb7a41a354cef2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241511
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68415}

Change-Id: I2cc4126c63238ddbd4f8bd784e0f7b1322c003ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2238028Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68414}

Instead of creating temporary {std::vector}s (which always allocate on
the heap) create more vectors on the stack, via initializer lists.

As this is "only" a fuzzer, performance is not really critical, but
still has some impact on the efficiency of the whole fuzzer.
That said, this CL is mostly a cleanup to replace unwanted code pattern
by better code.

R=jkummerow@chromium.org

Change-Id: I924c15e5d64ed584fc96c85715eef1dca5aef150
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2249928
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68413}

Change-Id: I02baea85ff93683848f2f5a4571a0d94d3821f0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2249673
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68412}

At this point in development, this is a reasonable config for the nci
test variant.

--turbo-nci currently disables some compiler phases and avoids
embedded context-dependent constants.
--turbo-collect-feedback-in-generic-lowering enables full feedback
collection in generic lowering.

I'm keeping the two as separate flags for now since it can be
interesting to benchmark --turbo-nci both with- and without feedback
collection.

Bug: v8:8888
Change-Id: I678baeb0ed051b158ac0634f00de9b6a55f87e09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2247770
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68411}

This changes PrepareFunctionForOptimization to have the same checks
as OptimizeFunctionOnNextCall, as otherwise fuzzing runs into
the DCHECK with a bad number of arguments.

Bug: chromium:1094866
Change-Id: Ief7d428a12139c47a74607d39792276a2eae4ebf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250255Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68410}

Bug: v8:7790
Change-Id: I759ccce7fc8d0fa6742b11ce9c05a254bf0728ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250256Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68409}