Good Build: 54.0.2826.0
Bad Build: 54.0.2827.0

ChangeLog info: 
https://chromium.googlesource.com/chromium/src/+log/54.0.2826.0..54.0.2827.0?pretty=fuller&n=10000

Suspecting: r411339

Note: Unable to narrow down the range as issue is not reproducible on chromium builds, hence providing suspect from changelog.

@asvitkine: Please help me reassign this issue, if your change is not cause for it.

Deleted: Actual_Video.mp4 1.1 MB

	Actual_Video.mp4 1.1 MB View Download

Deleted: Expected_Video.mp4 474 KB

	Expected_Video.mp4 474 KB View Download

Adding release block label, please undo if not the case.

r411339 only changed logging and should not affect behavior. Also, I'm OOO starting this afternoon, so can't help push this along.

Re-assigning to author of r411479 to help triage and because that change was actually seeking to change behavior.

I tried reverting my 411479 locally and confirmed that this is not due to my CL.

I did some more local bisecting, and it appears that the v8 roll in r411286 broke this (update to version 5.4.398).  Assigning to some v8 folks to triage further.

When running the broken version, I see the following message in DevTools just before the game load aborts:

UnityLoader.js:1 fatal flex scanner internal error--end of buffer missed

Sorry, correction to #4: the V8 roll that appears to cause this to fail is actually r411293 (Update V8 to version 5.4.399), not r411286.

Breakage seems to be in [1], although I don't quite understand the connection between the observed error & that CL. (Best as I know, the flash plugin doesn't use V8, so this is all a bit mysterious.)

https://chromium.googlesource.com/v8/v8/+/c0439051d63538099086c3e75012093f7052a487

I also (sometimes) get a tab crash with:

# Fatal error in ../../v8/src/compiler/scheduler.cc, line 1281
# Check failed: InsideSameDominatorChain(block, data->minimum_block_).

@jarin: Please have a look.

To reproduce, you'll have to build Chrome w/ flash plugin. (I suppose the root cause is unrelated to the flash plugin, but that's how to trigger the bug.)

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/dc330f2bd35656ecc133f7f329edee302a809935

commit dc330f2bd35656ecc133f7f329edee302a809935
Author: jarin <jarin@chromium.org>
Date: Wed Aug 24 17:13:54 2016

[turbofan] Fix merging of empty and non-empty state in load elimination.

Unfortunately, I was unable to produce a repro without asm.js. In normal
JavaScript, the bounds check renaming saves us.

I have not done anything about the index variable aliasing and handling
of differently sized elements yet!

BUG= chromium:639210 ,  v8:5266 

Review-Url: https://codereview.chromium.org/2270793004
Cr-Commit-Position: refs/heads/master@{#38874}

[modify] https://crrev.com/dc330f2bd35656ecc133f7f329edee302a809935/src/compiler/load-elimination.cc
[add] https://crrev.com/dc330f2bd35656ecc133f7f329edee302a809935/test/mjsunit/compiler/regress-639210.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/a124bf773fe1c5140d0a2e8849ffbc2246bc53fe

commit a124bf773fe1c5140d0a2e8849ffbc2246bc53fe
Author: bmeurer <bmeurer@chromium.org>
Date: Thu Aug 25 05:08:52 2016

[turbofan] Add regression tests for LoadElement/Field in diamond.

This introduces appropriate unit tests to ensure that merging of
elements/fields information is correct for diamonds.

BUG= chromium:639210 , v8:5266 
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2278043002
Cr-Commit-Position: refs/heads/master@{#38881}

[modify] https://crrev.com/a124bf773fe1c5140d0a2e8849ffbc2246bc53fe/test/unittests/compiler/load-elimination-unittest.cc