Vulnerability-introducing commit
================================

bc1263ec361c9d364438d66bf5cd311304eaee38
[maglev] Inline ArrayIteratorPrototypeNext
Author date: 2024-05-23 08:55:22 +0200
Commit date: 2024-05-23 07:27:40 +0000
Cr-Commit-Position: refs/heads/main@{#94042}
Change-Id: I99db77b9ecc468f95ca3e5362a0597ed3e1769aa

The parent has no TryReduceArrayIteratorPrototypeNext reducer. This commit adds
the complete reducer and the inlined-array path that derives elements_kind
directly from the captured map without a runtime map check.

Tested revisions
================

Initial target: 5068658e0b754814453e62dfe5898027ee052506
Current main:   3110f734eda952e4795c484fb698d1ec7df51392
Distance:       current main is 138 commits after the initial target

Chrome Stable 149.0.7827.115 embedded V8:
16ef80c1f5d3cfade812bd1743952a4cfd480a31
Version 14.9.207.27

bc1263ec361c9d364438d66bf5cd311304eaee38 is an ancestor of all three tested
V8 revisions.
