diff --git a/DEPS b/DEPS
index f63331a..74fde4b 100644
--- a/DEPS
+++ b/DEPS
@@ -58,7 +58,7 @@
   # Checkout extra javascript engines for testing or benchmarking.
   # d8, the V8 shell, is always checked out.
   "checkout_javascript_engines": False,
-  "d8_tag": "version:10.4.31",
+  "d8_tag": "version:10.5.100",
   "jsshell_tag": "version:95.0",
 
   # As Flutter does, we use Fuchsia's GN and Clang toolchain. These revision
@@ -81,7 +81,7 @@
   "args_rev": "73e8d3b55cbedc9765f8e266f3422d8914f8e62a",
   "async_rev": "f3ed5f690e2ec9dbe1bfc5184705575b4f6480e5",
   "bazel_worker_rev": "9710de6c9c70b1b583183db9d9721ba64e5a16fe",
-  "benchmark_harness_rev": "0ae822e264e410e9f1e927daea68601cc54906ef",
+  "benchmark_harness_rev": "f4ed0fcac4c284580263f0c548664dd548c9cca3",
   "boolean_selector_rev": "1d3565e2651d16566bb556955b96ea75018cbd0c",
   "boringssl_gen_rev": "ced85ef0a00bbca77ce5a91261a5f2ae61b1e62f",
   "boringssl_rev": "87f316d7748268eb56f2dc147bd593254ae93198",
diff --git a/runtime/tests/vm/dart/splay_ephemeron_test.dart b/runtime/tests/vm/dart/splay_ephemeron_test.dart
index 329d6d5..27853cc 100644
--- a/runtime/tests/vm/dart/splay_ephemeron_test.dart
+++ b/runtime/tests/vm/dart/splay_ephemeron_test.dart
@@ -103,7 +103,14 @@
 
   static void main() {
     mysetup();
-    new Splay().report();
+    // Don't use benchmark_harness - exercise runtime is not stable (so
+    // benchmark_harness measuring approach is meaningless for such benchmark
+    // anyway).
+    final sw = Stopwatch()..start();
+    final benchmark = new Splay();
+    while (sw.elapsedMilliseconds < 2000) {
+      benchmark.exercise();
+    }
     tearDown();
   }
 }
diff --git a/runtime/tests/vm/dart/splay_test.dart b/runtime/tests/vm/dart/splay_test.dart
index 1abb197..e508561 100644
--- a/runtime/tests/vm/dart/splay_test.dart
+++ b/runtime/tests/vm/dart/splay_test.dart
@@ -102,7 +102,14 @@
 
   static void main() {
     mysetup();
-    new Splay().report();
+    // Don't use benchmark_harness - exercise runtime is not stable (so
+    // benchmark_harness measuring approach is meaningless for such benchmark
+    // anyway).
+    final sw = Stopwatch()..start();
+    final benchmark = new Splay();
+    while (sw.elapsedMilliseconds < 2000) {
+      benchmark.exercise();
+    }
     tearDown();
   }
 }
diff --git a/runtime/tests/vm/dart_2/splay_ephemeron_test.dart b/runtime/tests/vm/dart_2/splay_ephemeron_test.dart
index 7ab290a..580cd77 100644
--- a/runtime/tests/vm/dart_2/splay_ephemeron_test.dart
+++ b/runtime/tests/vm/dart_2/splay_ephemeron_test.dart
@@ -102,7 +102,14 @@
 
   static void main() {
     mysetup();
-    new Splay().report();
+    // Don't use benchmark_harness - exercise runtime is not stable (so
+    // benchmark_harness measuring approach is meaningless for such benchmark
+    // anyway).
+    final sw = Stopwatch()..start();
+    final benchmark = new Splay();
+    while (sw.elapsedMilliseconds < 2000) {
+      benchmark.exercise();
+    }
     tearDown();
   }
 }
diff --git a/runtime/tests/vm/dart_2/splay_test.dart b/runtime/tests/vm/dart_2/splay_test.dart
index f1b401e..f0474f6 100644
--- a/runtime/tests/vm/dart_2/splay_test.dart
+++ b/runtime/tests/vm/dart_2/splay_test.dart
@@ -101,7 +101,14 @@
 
   static void main() {
     mysetup();
-    new Splay().report();
+    // Don't use benchmark_harness - exercise runtime is not stable (so
+    // benchmark_harness measuring approach is meaningless for such benchmark
+    // anyway).
+    final sw = Stopwatch()..start();
+    final benchmark = new Splay();
+    while (sw.elapsedMilliseconds < 2000) {
+      benchmark.exercise();
+    }
     tearDown();
   }
 }
diff --git a/runtime/vm/compiler/frontend/kernel_binary_flowgraph.cc b/runtime/vm/compiler/frontend/kernel_binary_flowgraph.cc
index aeb0cab..ff0c9bc 100644
--- a/runtime/vm/compiler/frontend/kernel_binary_flowgraph.cc
+++ b/runtime/vm/compiler/frontend/kernel_binary_flowgraph.cc
@@ -1169,7 +1169,9 @@
   return BuildStatement();  // read statement.
 }
 
-Fragment StreamingFlowGraphBuilder::BuildExpression(TokenPosition* position) {
+Fragment StreamingFlowGraphBuilder::BuildExpression(
+    TokenPosition* position,
+    bool allow_late_uninitialized) {
   ++num_ast_nodes_;
   uint8_t payload = 0;
   Tag tag = ReadTag(&payload);  // read tag.
@@ -1177,9 +1179,9 @@
     case kInvalidExpression:
       return BuildInvalidExpression(position);
     case kVariableGet:
-      return BuildVariableGet(position);
+      return BuildVariableGet(position, allow_late_uninitialized);
     case kSpecializedVariableGet:
-      return BuildVariableGet(payload, position);
+      return BuildVariableGet(payload, position, allow_late_uninitialized);
     case kVariableSet:
       return BuildVariableSet(position);
     case kSpecializedVariableSet:
@@ -5818,26 +5820,12 @@
   ASSERT(positional_count == 1);
 
   // The CFE transform only generates a subset of argument expressions:
-  // either variable get or `this`.
-  uint8_t payload = 0;
-  Tag tag = ReadTag(&payload);
+  // either variable get or `this`. However, subsequent transforms can
+  // generate different expressions, including: constant expressions.
+  // So, build an arbitrary expression here instead.
   TokenPosition* position = nullptr;
   const bool allow_late_uninitialized = true;
-  Fragment code;
-  switch (tag) {
-    case kVariableGet:
-      code = BuildVariableGet(position, allow_late_uninitialized);
-      break;
-    case kSpecializedVariableGet:
-      code = BuildVariableGet(payload, position, allow_late_uninitialized);
-      break;
-    case kThisExpression:
-      code = BuildThisExpression(position);
-      break;
-    default:
-      // The transformation should not be generating anything else.
-      FATAL1("Unexpected tag %i", tag);
-  }
+  Fragment code = BuildExpression(position, allow_late_uninitialized);
 
   const intptr_t named_args_len = ReadListLength();
   ASSERT(named_args_len == 0);
diff --git a/runtime/vm/compiler/frontend/kernel_binary_flowgraph.h b/runtime/vm/compiler/frontend/kernel_binary_flowgraph.h
index 4547f0e..feb6d48 100644
--- a/runtime/vm/compiler/frontend/kernel_binary_flowgraph.h
+++ b/runtime/vm/compiler/frontend/kernel_binary_flowgraph.h
@@ -70,7 +70,8 @@
   Fragment BuildInitializers(const Class& parent_class);
   FlowGraph* BuildGraphOfFunction(bool constructor);
 
-  Fragment BuildExpression(TokenPosition* position = nullptr);
+  Fragment BuildExpression(TokenPosition* position = nullptr,
+                           bool allow_late_uninitialized = false);
   Fragment BuildStatement(TokenPosition* position = nullptr);
   Fragment BuildStatementWithBranchCoverage(TokenPosition* position = nullptr);
 
diff --git a/tests/ffi/regress_49402_test.dart b/tests/ffi/regress_49402_test.dart
new file mode 100644
index 0000000..e31384b
--- /dev/null
+++ b/tests/ffi/regress_49402_test.dart
@@ -0,0 +1,13 @@
+// Copyright (c) 2022, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+import 'dart:ffi';
+
+class A implements Finalizable {}
+
+void b([A? a]) {}
+
+void main() {
+  b();
+}
diff --git a/tests/ffi_2/regress_49402_test.dart b/tests/ffi_2/regress_49402_test.dart
new file mode 100644
index 0000000..e9a71ba
--- /dev/null
+++ b/tests/ffi_2/regress_49402_test.dart
@@ -0,0 +1,15 @@
+// Copyright (c) 2022, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// @dart=2.9
+
+import 'dart:ffi';
+
+class A implements Finalizable {}
+
+void b([A a]) {}
+
+void main() {
+  b();
+}
diff --git a/tools/VERSION b/tools/VERSION
index 5ca3105..d82a1f5 100644
--- a/tools/VERSION
+++ b/tools/VERSION
@@ -27,5 +27,5 @@
 MAJOR 2
 MINOR 18
 PATCH 0
-PRERELEASE 261
+PRERELEASE 262
 PRERELEASE_PATCH 0
\ No newline at end of file