v8:6700 should address this issue.

Issue 755209 has been merged into this issue.

Regressions associated with this bug:   
  https://chromeperf.appspot.com/group_report?bug_id=754751

Issue 755210 has been merged into this issue.

Issue 755149 has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/313f8d3fcb71b66fcc3e3028bb87505c053e1f90

commit 313f8d3fcb71b66fcc3e3028bb87505c053e1f90
Author: Michael Starzinger <mstarzinger@chromium.org>
Date: Tue Aug 22 08:50:26 2017

[asm.js] Fix heap access validation of shift expressions.

This makes sure that shift expressions (not wrapped in parentheses) can
appear as part of the index in a valid heap access expression. Only the
last operand of a sequence of shift expressions is taken into account
when validating the heap access.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-6700
BUG= v8:6700 , chromium:754751 

Change-Id: Icc7a71bd64461da4d3daea41b995964e3dfc6dc6
Reviewed-on: https://chromium-review.googlesource.com/623811
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47497}
[modify] https://crrev.com/313f8d3fcb71b66fcc3e3028bb87505c053e1f90/src/asmjs/asm-parser.cc
[modify] https://crrev.com/313f8d3fcb71b66fcc3e3028bb87505c053e1f90/src/asmjs/asm-parser.h
[add] https://crrev.com/313f8d3fcb71b66fcc3e3028bb87505c053e1f90/test/mjsunit/regress/regress-6700.js

The change in comment #7 fixed the issue, "Bullet" is now validating as correct asm.js code. Looking at the graphs, the two recent regressions recovered and we are now at an overall improvement of around 30% across all architectures compared to two weeks ago. This is fixed.