There are instructions that take 7 bytes, e.g.
4881ec10000000 REX.W subq rsp,0x10
Hence increase the padding from 12 characters to 14 characters to
restore alignment.
Drive-by: Rewrite the padding loop to make it more readable and add a
comment.
R=jkummerow@chromium.org
Change-Id: Iddd6a721574fc47b4a072fe40c2f5e90cb3d1186
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996200
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75480}
The {EnterFrame} and {LeaveFrame} methods will already emit a (scoped)
code comment in the form
[ EnterFrame
... instructions ...
]
Thus skip the additional code comment emitted by Liftoff.
R=ahaas@chromium.org
Bug: v8:11879
Change-Id: I488568022cb03b16f07a12c1a575d90613691758
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996197
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75479}
Extern ref in Liftoff is enabled since M-90
(https://crrev.com/c/2625886), hence remove the flag to simplify the
code.
R=ahaas@chromium.org
Bug: v8:11879
Change-Id: Ie72dfbc006d6f42e2e9e83d44ff78e3c53a82614
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996195
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75478}
We currently merge i32 binary operations with a subsequent if or br_if,
and we merge i32.eqz with a subsequent br_if. The combination i32.eqz +
if was missing, even thought there is already support for that in the
"if" handler.
R=ahaas@chromium.org
Change-Id: Id4386d0c5d6dcf3605c72ea1146169d2088abe98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996196
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75477}
Design doc: https://bit.ly/3xPxWUe
This CL introduces two main changes:
- Initializer expressions are now decoded by WasmFullDecoder. With
wasm-gc, initializer expressions are no longer just constants, and
require complex decoding (including stack tracking). This resulted in
extensive code duplication.
- Initializer expressions are not stored explicitly by module-decoder as
an AST (WasmInitExpr), but rather as a WireBytesRef, and are decoded
again during module instantiation. This should reduce memory
consumption for globals and other module elements with initializer
expressions (which has been observed in the 40MB range in some
real-world benchmarks.
Summary of changes:
- Add a static parameter {kFunctionBody, kInitExpression} to the
WasmDecoder. Use it to specialize validation to function bodies/init.
expressions.
- Introduce a new Interface for the WasmFullDecoder for init.
expressions.
- Differentiate between constant and non-constant opcodes in
WasmFullDecoder.
- Change representation of init. expressions in WasmModule to
WireBytesRef.
- Reimplement EvaluateInitExpression in module-instantiate to re-decode
initializer expressions.
- Remove some now-invalid module decoder tests.
Pending changes:
- Also refactor initializer expressions for element segment entries.
- Reintroduce deleted tests.
Bug: v8:11895
Change-Id: I76512bfe1386c8338667d30fa6db93880a1e4b42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2972910
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75476}
If the object to be trimmed creates a filler object that is located just
before the current LAB, then we can immediately give back the memory.
Bug: v8:11872, v8:11883
Change-Id: I9ec37443482334003b3752a3f25fc5dcb6a476fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996643
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75475}
Those flags are old, not commonly used, and redundant. People usually
rely on external tools to disassembly wasm functions or modules.
Also, the name is misleading as Wasm is not an AST (any more).
R=ahaas@chromium.org
Bug: v8:11879
Change-Id: I0f90d142ae4c7c6b7ee6013ea033951aad6bf133
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996194
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75474}
This will automatically skip the test in the stress_snapshot variant,
where Wasm is not supported.
R=cbruni@chromium.org
Bug: v8:11937
Change-Id: I29078e070a7b1526470e15d8667c5256ea4d8fe1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996642
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75473}
This adds back two spaces that went missing in
https://crrev.com/c/2978252, removing the space between offset and
instruction bytes.
After https://crrev.com/c/2978252:
0x21ea0e1e04a0 055 push rbp
0x21ea0e1e04a1 14889e5 REX.W movq rbp,rsp
After this CL:
0x2be7c8c604a0 0 55 push rbp
0x2be7c8c604a1 1 4889e5 REX.W movq rbp,rsp
R=delphick@chromium.org
Change-Id: I6df35aed9b5909da72965fef622b07120c226fae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996199
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75472}
.. and make JSGlobalObjectRef bg-serialized.
GetPropertyCell was implemented as:
LookupIterator it(holder, isolate, name, LookupIterator::OWN);
it.TryLookupCachedProperty();
if (it.state() == LookupIterator::DATA) it.GetPropertyCell();
Due to concurrency requirements, we essentially have to reimplement
this entire path for use in a concurrent setting:
- Reads in some cases have to use relaxed or acquire semantics.
- The IsPendingAllocation predicate must be called on some objects
before reading into them.
- Repeated reads of the same field must be avoided due to the
possibility of concurrent modifications.
This CL introduces two new methods:
ConcurrentLookupIterator::TryGetPropertyCell implements the outer
lookup logic, including the repeated lookup for accessors / cached
property names.
GlobalDictionary::TryFindPropertyCellForConcurrentLookupIterator is a
slightly modified HashTable::FindEntry which follows the above rules.
Bug: v8:7790
Change-Id: Ic9a52da766afdfedce8efcbda92876845a17eed9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2959616
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75467}
Adds support for a seperate dynamic map checks trampoline that takes the
feedback vector as an argument rather than reading it from the stack
frame, to enable it to work for inlined functions. Plumbs the logic
through the compiler to select between these trampolines based on the
framestate.
BUG=v8:9684,chromium:1224367
Change-Id: Ibc7facdc78930aedec4a102693a926f64f6de7e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992724
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75461}
When failing to construct a Ref, it helps debugging knowing which class
is the one we failed to create.
Bug: v8:7790
Change-Id: I22388920633fe2155c7b4fa712c5dead25a2f2d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992726
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75460}
This flag only controls whether d8 installs the signal handler for wasm
traps. Hence it should be a d8-only flag, to avoid confusion if used in
other embeddings.
We just introduced --wasm-enforce-bounds-checks to do what you might
think --no-wasm-trap-handler would do.
R=ahaas@chromium.org
Bug: v8:11926
Change-Id: Ic1f33af36236a2981cf060f450bbfd02e51d9793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2989130
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75459}
`SharedFunctionInfo` is defined under the added header and
not having it included causes this compilation error:
variable has incomplete type 'v8::internal::SharedFunctionInfo'
Change-Id: Ieb0e8f89043f91decdc93f8b3e3c5ed29c0043c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2989133
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75458}
... but keep/make subclass-specific methods do direct reads.
Bug: v8:7790
Change-Id: Ia4b9d207ce75cf28f6f0f33027ab05e27db49ce9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2959621
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75457}
The following compilation error is thrown if a platform
does not have sparkplug implanted:
error: code will never be executed
Change-Id: Ifbf2162ec9580f86620ca2bfd1007d96da2a4138
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992889
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75455}
Call it NativeContextRef::GlobalIsDetached and implement it on top of
Refs such that it can benefit from direct reads.
Drive-by: inline a JSNativeContextSpecialization::ReduceGlobalAccess
overload into its only callsite.
Bug: v8:7790
Change-Id: I1c6891e0fc65a476b0c4587f3fde2c6461b302a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2959614
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75454}
There currently is no way to enforce explicit bounds checks if the
embedder installed the signal handler for wasm trap handling (queried
via {trap_handler::IsTrapHandlerEnabled()}).
This CL adds a respective flag and makes all compilation emit explicit
bounds checks if it is disabled.
R=ahaas@chromium.org
Bug: v8:11926
Change-Id: Ie19faab1766d3105f3c22cb4470c0f15398f1d09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2989129
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75453}
.. now that all JSObjectRef methods can run in concurrent settings.
Also change a few subtypes to bg-serialized:
- JSArray
- JSGlobalProxy
- JSTypedArray
Bug: v8:7790
Change-Id: I406b0a8eacb4e5bd2c3a24eb106b29df2cf55421
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2966377
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75452}
https://crrev.com/c/2972915 previously added more gitignore files to the
repository. This left the repo dirty after running mjsunit tests due to
lingering .log files.
- Add test/mjsunit/tools/tmp dir to keep and ignore temporary log files
without the need for a platform specific tmp dir
- Use temporary logfiles with --logfile=+ for log-ci.js tests
Change-Id: I1b1a47f45603d6c3027c6ca7050c78e8df0664ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992720
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75451}
MSVC is not happy about conditionally increasing the buffer size for
builtin code generation with --code-comments.
Previous CL: https://crrev.com/c/2976651
Change-Id: Ic257eecfc9c41835d8ae4cf2de595fd5c427a7e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992721
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75450}
Rolling v8/build: 73a9443..b342bb3
Rolling v8/buildtools/third_party/libc++abi/trunk: 73e7404..d46361b
Rolling v8/buildtools/third_party/libunwind/trunk: a38ef11..9303368
Rolling v8/third_party/aemu-linux-x64: A1XxYDWVeZi3lNSg1lZdcmGtIB2fA0XTIPYdevon60YC..kZbnq1Wh_y69PWihHdedFiEIQANIiZchdysb5-fpBTEC
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/11a2ddf..2bc697b
Rolling v8/third_party/jinja2: 6906af9..7c54c1f
Rolling v8/third_party/markupsafe: 0944e71..1b882ef
Rolling v8/tools/clang: 04e2c7e..5633839
Rolling v8/tools/luci-go: git_revision:8ed83b4afa51020c8900d121bb57624b35882dec..git_revision:ede472114f4e51eaa068cd84cadcf470773f19ef
Rolling v8/tools/luci-go: git_revision:8ed83b4afa51020c8900d121bb57624b35882dec..git_revision:ede472114f4e51eaa068cd84cadcf470773f19ef
Rolling v8/tools/luci-go: git_revision:8ed83b4afa51020c8900d121bb57624b35882dec..git_revision:ede472114f4e51eaa068cd84cadcf470773f19ef
TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com
Change-Id: I1f462a8309ddec306f06fe6aae584176eb375aa9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2995605
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#75448}
Add Label::Distance flag to control emit Branchshort.
Change-Id: I418024ea530ae41788c5684bb8bd2044311a99d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2959266
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/master@{#75447}
%SimulateFullSpace uses PauseAllocationObserversScope internally and
so does a GC. When there happens to be a GC during %SimulateFullSpace
(caused by --stress-concurrent-allocation here), then the DCHECK in
AllocationCounter::Pause would fail because it was already paused.
Solve this by counting the number of active
PauseAllocationObserversScopes.
Bug: v8:11936
Change-Id: I86487c24fd33739fd7e6635501b5f0257806c4bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992727
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75446}
Flags are also updated under `instruction-selector` to include
these operations. Not having them was causing their Simd versions
to remain unused as well. V8 was just interpreting them at runtime.
Change-Id: I42677f7412859ad4759b70ba16667ec9d90505af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2994803
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#75444}
This is a reland of edab873071
It was speculatively reverted but the issue turned out to just be slow
tests.
Original change's description:
> Fix -Wimplicit-int-float-conversions.
>
> Bug: chromium:989932
> Change-Id: Ief917b023cb079f5ff87dc8963d74f225d074d7a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2989096
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Auto-Submit: Peter Kasting <pkasting@chromium.org>
> Commit-Queue: Peter Kasting <pkasting@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75413}
Bug: chromium:989932
Change-Id: Iec8ac8ee32705c6a699a2df2f292ffe07cde99f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2994802
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75443}
The accessor flattening code checks for the "description" property of
Symbols. But the incoming object is a JSReceiver (expressed as
v8::Object on the public API) and thus can never be a Symbol (which is a
primitive value). So this check is always false.
Bug: chromium:1076820
Change-Id: I5190d515cabcfcf052530c251a5ebfe946ae1742
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2991245
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75440}
Several headers in the large inline objects header cycle were depending
on deserializer.h to access Deserializer::uninitialized_field_value().
Unfortunately this meant that a change to many snapshot headers caused a
rebuild of over 1480 files.
This moves the constant into smi.h which would always be included by the
objects inline headers.
Bug: v8:11879
Change-Id: I2efd1c42efd43e6cd4630cea7fd76dd2bd29ae3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992717
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75439}
WasmValueObjects used to not have a constructor defined. That prevents
custom devtoolsFormatters from being applied to such objects.
Change-Id: Id775cdb710d0c4106f70858cc1fc92b1f8bd4590
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2991243
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75438}
Add common TimelineTrackStackedBase base class for TimelineTrackTick
and TimelineTrackTimer for visualising stacked time ranges that only
need rescaling when zooming in.
Additional changes:
- Highlight matching registers in disassembly
- Simplify CodeLogEntry summary for script code
- Show event for array items in the property-link-table
Bug: v8:10644
Change-Id: I0b37274e12ba55f1c6251b90d39d996ffae7f37e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992716
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75437}
WasmFeatures::FromIsolate() was called without a HandleScope in the
original CL. This was fixed by using the WasmFeatures from the
NativeModule instead of calling WasmFeatures::FromIsolate.
Original message:
Initializing the compilation progress first, and making it an explicit
step, allows us to share the wrapper compilation code between async
compilation and streaming compilation. In the future it will also allow
us to initialize compilation units based on the compilation progress,
which will allow us to share more code between async compilation and
deserialization.
R=clemensb@chromium.org
Bug: v8:11862
Change-Id: Id2d0990e5c7fa0f266f730f7e0bfa24fe641497b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2993029
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75436}
Fix a sanitizer undefined behavior error found by the fuzzer in
function AddAll32BitIntFastCallback_6Args, due to a possible integer
underflow or overflow.
Bug: chromium:1223873
Change-Id: Ibef53ce2b4421bed5154a694fb607d36f2bba28a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2993551
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75435}
Lite-mode test runs were running tests with
--stress-concurrent-inlining, and this results in a flag contradiction.
Bug: v8:11907
Change-Id: I7c0c697af8b1f197f8c7735f62677943d91ebb91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2983203
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75434}
This CL skips some recently added tests that do not work for TPH at the moment,
including:
* One uses --concurrent_inlining
* One Requires local heaps
* 7 tests that create multiple isplates
* 3 LogMaps* tests that is expected to fail due to map address reuse
This CL also set v8_enable_allocation_folding = true for TPH.
Bug: v8:11641
Change-Id: I5db32f5f9e730dc4e12e4869ec78210bde23ca0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2994219
Commit-Queue: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75432}
